npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 598
Updated 27 Oct 2026, 09:57 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3433 blocks this version. The package @beproduct/nestjs-auth was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-5561 blocks this version. OSV/OpenSSF confirms @bestlzk/sectest@1.0.0 as malicious package MAL-2026-5561. Malicious code in @bestlzk/sectest (npm)
OpenSSF/OSV malware advisory MAL-2026-3365 blocks this version. The package @b2bneo-rest/api-csf was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2025-6903 blocks this version. OSV/OpenSSF confirms @hornetsecurity/angular-search-box@18.0.0 as malicious package MAL-2025-6903. Malicious code in @horne...
OpenSSF/OSV malware advisory MAL-2026-5521 blocks this version. On `npm install`, the postinstall hook runs `node index.js`, which performs an HTTPS POST to `https://f1ackavab3.execute-ap...
OpenSSF/OSV malware advisory MAL-2026-6494 blocks this version. @help-forms/application-aff@3.4.3 ships a heavily obfuscated postinstall script (scripts/postinstall.js, obfuscator.io fing...
OpenSSF/OSV malware advisory MAL-2026-6140 blocks this version. @httpactions/strict-uri-encode impersonates the popular unscoped npm package 'strict-uri-encode' (~30M weekly downloads) by...
OpenSSF/OSV malware advisory MAL-2026-6139 blocks this version. The package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On requ...
OpenSSF/OSV malware advisory MAL-2026-6139 blocks this version. The package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On requ...
OpenSSF/OSV malware advisory MAL-2026-4265 blocks this version. @asavie/i18n@99.0.0 is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a `preins...
OpenSSF/OSV malware advisory MAL-2026-4265 blocks this version. @asavie/i18n@99.0.0 is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a `preins...
OpenSSF/OSV malware advisory MAL-2026-4265 blocks this version. @asavie/i18n@99.0.0 is a dependency-confusion package targeting an unclaimed npm scope. Its package.json declares a `preins...
OpenSSF/OSV malware advisory MAL-2026-4160 blocks this version. The package @apps-home-dashboard/events was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6211 blocks this version. @apiwizards/auth-middleware@5.1.2 ships a single heavily obfuscated index.js (obfuscator.io string-array with 317 entries,...
OpenSSF/OSV malware advisory MAL-2026-6211 blocks this version. @apiwizards/auth-middleware@5.1.2 ships a single heavily obfuscated index.js (obfuscator.io string-array with 317 entries,...