npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 614
Updated 26 Oct 2026, 14:19 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11017 blocks this version. vectormark@1.0.0 advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function...
OpenSSF/OSV malware advisory MAL-2026-11033 blocks this version. The package is advertised as an Ethereum ABI code generator but its `index.js` is a verbatim copy of the unrelated `mongoo...
OpenSSF/OSV malware advisory MAL-2026-11033 blocks this version. The package is advertised as an Ethereum ABI code generator but its `index.js` is a verbatim copy of the unrelated `mongoo...
OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...
OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...
OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...
OpenSSF/OSV malware advisory MAL-2026-10935 blocks this version. The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user '...
OpenSSF/OSV malware advisory MAL-2026-10938 blocks this version. The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user '...
OpenSSF/OSV malware advisory MAL-2026-10935 blocks this version. The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user '...
OpenSSF/OSV malware advisory MAL-2026-10938 blocks this version. The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user '...
OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...
OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...
OpenSSF/OSV malware advisory MAL-2026-10957 blocks this version. The iphouse package was published to the npm registry by user 'jonothhu' (maintainer email bruemleveroger@gmail.com) as on...
OpenSSF/OSV malware advisory MAL-2026-10923 blocks this version. package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPu...
OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...
OpenSSF/OSV malware advisory MAL-2026-10767 blocks this version. The syft-acp-util package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part...
OpenSSF/OSV malware advisory MAL-2026-10766 blocks this version. The syft-acp-uikit package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part...
OpenSSF/OSV malware advisory MAL-2026-11473 blocks this version. LPM AI assessed this version as clean; the assessments disagree. metrics-ui is a functionally empty npm package (hollow in...
OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...
OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...
OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...
OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...
OpenSSF/OSV malware advisory MAL-2026-11087 blocks this version. The package's main entry (src/server.js) is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes...
OpenSSF/OSV malware advisory MAL-2026-11512 blocks this version. The package's main module exports a function `command()` that invokes `/bin/bash -c` to fetch a script from reverse-shell....
OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...