npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 613
Updated 26 Oct 2026, 13:41 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11546 blocks this version. Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launche...
OpenSSF/OSV malware advisory MAL-2026-11550 blocks this version. On require() of the package, index.js loads _compat.js which downloads a platform-specific binary from obfuscated Cloudfla...
OpenSSF/OSV malware advisory MAL-2026-11488 blocks this version. On require/import (and when invoked as a bin), the package's main entrypoint detects Windows and installs an HKCU\Software...
OpenSSF/OSV malware advisory MAL-2026-11489 blocks this version. The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitra...
OpenSSF/OSV malware advisory MAL-2026-11495 blocks this version. The package exports a Helper class that implements two installer-harming primitives on Windows. First, start() launches a...
OpenSSF/OSV malware advisory MAL-2026-11493 blocks this version. test-dev-store is a library module of an infostealer toolkit. utils.js exports path builders that specifically target Chro...
OpenSSF/OSV malware advisory MAL-2026-11497 blocks this version. index.js contains two base64 constants that decode to the shell command `npm install rollup-plugin-polyfill-helper --no-sa...
OpenSSF/OSV malware advisory MAL-2026-11479 blocks this version. The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPlug...
OpenSSF/OSV malware advisory MAL-2026-11193 blocks this version. This npm package (a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module) ships a preinsta...
OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...
OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...
OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...
OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...
OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...
OpenSSF/OSV malware advisory MAL-2026-11548 blocks this version. The package advertises itself as a JavaScript day-math helper but its ESM main entry (dist/index.mjs) unconditionally spaw...
OpenSSF/OSV malware advisory MAL-2026-11541 blocks this version. package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively s...
OpenSSF/OSV malware advisory MAL-2026-11101 blocks this version. Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single ~105KB obfus...
OpenSSF/OSV malware advisory MAL-2026-11461 blocks this version. The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-ut...
OpenSSF/OSV malware advisory MAL-2026-11034 blocks this version. eth-slint is a typosquat of web3-core-subscriptions. src/index.js contains a clean 2119-byte copy of the legitimate web3.j...
OpenSSF/OSV malware advisory MAL-2026-11033 blocks this version. The package is advertised as an Ethereum ABI code generator but its `index.js` is a verbatim copy of the unrelated `mongoo...
OpenSSF/OSV malware advisory MAL-2026-11020 blocks this version. On module load, the package schedules a randomized 5-15 second setTimeout that POSTs a JSON body containing os.hostname(),...
OpenSSF/OSV malware advisory MAL-2026-11012 blocks this version. index.js is a heavily obfuscated loader (rotated string-array decoder, control-flow flattening, self-defending/console-tam...
OpenSSF/OSV malware advisory MAL-2026-11012 blocks this version. index.js is a heavily obfuscated loader (rotated string-array decoder, control-flow flattening, self-defending/console-tam...
OpenSSF/OSV malware advisory MAL-2026-11012 blocks this version. index.js is a heavily obfuscated loader (rotated string-array decoder, control-flow flattening, self-defending/console-tam...
OpenSSF/OSV malware advisory MAL-2026-10971 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. cxpw-offers ships an empty index.js and declares its...