npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 597
Updated 27 Oct 2026, 09:26 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-4394 blocks this version. @ikyyofc/gemini-cli@3.0.1 ships two heavily obfuscated modules (src/gemini.js and src/utils/proxy.js) wrapped in an obfusca...
OpenSSF/OSV malware advisory MAL-2026-4394 blocks this version. @ikyyofc/gemini-cli@3.0.1 ships two heavily obfuscated modules (src/gemini.js and src/utils/proxy.js) wrapped in an obfusca...
OpenSSF/OSV malware advisory MAL-2026-4394 blocks this version. @ikyyofc/gemini-cli@3.0.1 ships two heavily obfuscated modules (src/gemini.js and src/utils/proxy.js) wrapped in an obfusca...
OpenSSF/OSV malware advisory MAL-2026-4394 blocks this version. @ikyyofc/gemini-cli@3.0.1 ships two heavily obfuscated modules (src/gemini.js and src/utils/proxy.js) wrapped in an obfusca...
OpenSSF/OSV malware advisory MAL-2026-4396 blocks this version. On `npm install`, scripts/postinstall.js runs as the preinstall/postinstall lifecycle hook and performs an unambiguous inst...
OpenSSF/OSV malware advisory MAL-2026-4396 blocks this version. On `npm install`, scripts/postinstall.js runs as the preinstall/postinstall lifecycle hook and performs an unambiguous inst...
OpenSSF/OSV malware advisory MAL-2026-4396 blocks this version. On `npm install`, scripts/postinstall.js runs as the preinstall/postinstall lifecycle hook and performs an unambiguous inst...
OpenSSF/OSV malware advisory MAL-2026-4396 blocks this version. On `npm install`, scripts/postinstall.js runs as the preinstall/postinstall lifecycle hook and performs an unambiguous inst...
OpenSSF/OSV malware advisory MAL-2026-3184 blocks this version. The package @breezeai-frontend/tailwind-config was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3184 blocks this version. The package @breezeai-frontend/tailwind-config was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3184 blocks this version. The package @breezeai-frontend/tailwind-config was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3183 blocks this version. The package @breezeai-frontend/cargo-ui was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3183 blocks this version. The package @breezeai-frontend/cargo-ui was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3183 blocks this version. The package @breezeai-frontend/cargo-ui was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3293 blocks this version. The package @breezeai-frontend/i18n-config was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3293 blocks this version. The package @breezeai-frontend/i18n-config was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3292 blocks this version. The package @breeze-ai/ui-library was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3292 blocks this version. The package @breeze-ai/ui-library was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.