npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 595
Updated 27 Oct 2026, 08:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3059 blocks this version. package.json declares `preinstall` and `install` lifecycle hooks that collect installer-identifying data (`whoami`, `hostna...
OpenSSF/OSV malware advisory MAL-2026-3058 blocks this version. The package @clearpool/table was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3058 blocks this version. The package @clearpool/table was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3058 blocks this version. The package @clearpool/table was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4257 blocks this version. The OpenSSF Package Analysis project identified '@cloudways-lab/unified-design-system' @ 99.9.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-6069 blocks this version. The package declares `"preinstall": "node index.js"` in package.json, causing index.js to execute automatically on `npm ins...
OpenSSF/OSV malware advisory MAL-2026-6069 blocks this version. The package declares `"preinstall": "node index.js"` in package.json, causing index.js to execute automatically on `npm ins...
OpenSSF/OSV malware advisory MAL-2026-4256 blocks this version. The OpenSSF Package Analysis project identified '@citi-icg-171632/citicms-repo-component' @ 99.9.1 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3808 blocks this version. The package @citi-icg-158830/icgds-react-css was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3806 blocks this version. The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3806 blocks this version. The package @citi-icg-158830/elemental-chameleon was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3807 blocks this version. The package @citi-icg-158830/elemental-ui-react was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3807 blocks this version. The package @citi-icg-158830/elemental-ui-react was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5095 blocks this version. The OpenSSF Package Analysis project identified '@challenger6/vm-pattern-library' @ 99.0.0 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-3682 blocks this version. The package's postinstall script (package.json line 10: "postinstall": "node install.js") unconditionally fetches a platfor...
OpenSSF/OSV malware advisory MAL-2026-3336 blocks this version. The package @channel_bot/xa0 was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3681 blocks this version. The package declares a postinstall lifecycle hook (`"postinstall": "node postinstall.js"` in package.json) that runs automa...
OpenSSF/OSV malware advisory MAL-2026-6521 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs unconditionally on `npm install`. index.js imports chil...
OpenSSF/OSV malware advisory MAL-2026-4161 blocks this version. The package @cap-js/openapi was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6120 blocks this version. The package ships setup.cjs containing heavily obfuscated JavaScript with hex-mangled identifiers (_0x32549a, _0x4b2b44, _0...
OpenSSF/OSV malware advisory MAL-2026-3256 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...
OpenSSF/OSV malware advisory MAL-2026-6529 blocks this version. The package ships a binding.gyp at the package root containing GYP command-expansion syntax (`<!(...)`) in its sources/targ...