npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 606
Updated 26 Oct 2026, 08:44 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11937 blocks this version. npm/@servicetitan/titan-chat-ui-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11936 blocks this version. npm/@servicetitan/titan-chat-ui-anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11937 blocks this version. npm/@servicetitan/titan-chat-ui-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11936 blocks this version. npm/@servicetitan/titan-chat-ui-anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-11937 blocks this version. npm/@servicetitan/titan-chat-ui-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-0...
OpenSSF/OSV malware advisory MAL-2026-12020 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12025 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12023 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12019 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12018 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12017 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12007 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12016 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12015 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12012 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12008 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12014 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12013 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12011 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12010 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12009 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12022 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12021 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-12024 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-11995 blocks this version. The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/...