npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 616
Updated 26 Oct 2026, 15:39 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11507 blocks this version. On any require of the package, index.js loads _polyfill.js which downloads a platform-specific binary from obfuscated Clou...
OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...
OpenSSF/OSV malware advisory MAL-2026-11522 blocks this version. Package advertises itself as a React UI toolkit but on require(), _helpers.js runs init() at module load which selects a p...
OpenSSF/OSV malware advisory MAL-2026-11506 blocks this version. beaver-ui-date-range-picker@12.5.3 declares a postinstall hook (`node setup.js`) and additionally triggers the same script...
OpenSSF/OSV malware advisory MAL-2026-11504 blocks this version. Requiring accounts-final-form auto-runs setup.js via process.nextTick(bootstrap) in index.js. setup.js selects a platform-...
OpenSSF/OSV malware advisory MAL-2026-11485 blocks this version. The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services (AWS...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...
OpenSSF/OSV malware advisory MAL-2026-11510 blocks this version. The package is advertised as a React UI layout library but on require('beaver-ui-layout') loads _bridge.js, which reconstr...
OpenSSF/OSV malware advisory MAL-2026-11509 blocks this version. The package's declared postinstall (`node setup.js`) and its main entry `index.js` (which unconditionally calls `require('...
OpenSSF/OSV malware advisory MAL-2026-11508 blocks this version. beaver-ui-header@12.3.9 advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and aga...
OpenSSF/OSV malware advisory MAL-2026-11507 blocks this version. On any require of the package, index.js loads _polyfill.js which downloads a platform-specific binary from obfuscated Clou...
OpenSSF/OSV malware advisory MAL-2026-11506 blocks this version. beaver-ui-date-range-picker@12.5.3 declares a postinstall hook (`node setup.js`) and additionally triggers the same script...
OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...
OpenSSF/OSV malware advisory MAL-2026-11504 blocks this version. Requiring accounts-final-form auto-runs setup.js via process.nextTick(bootstrap) in index.js. setup.js selects a platform-...
OpenSSF/OSV malware advisory MAL-2026-11504 blocks this version. Requiring accounts-final-form auto-runs setup.js via process.nextTick(bootstrap) in index.js. setup.js selects a platform-...
OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...
OpenSSF/OSV malware advisory MAL-2026-11504 blocks this version. Requiring accounts-final-form auto-runs setup.js via process.nextTick(bootstrap) in index.js. setup.js selects a platform-...
OpenSSF/OSV malware advisory MAL-2026-11491 blocks this version. test-dev-host@0.1.0 connects out to a hardcoded socket server (host/port sourced from the test-dev-config module) and ente...
OpenSSF/OSV malware advisory MAL-2026-11366 blocks this version. Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json dec...
OpenSSF/OSV malware advisory MAL-2026-11366 blocks this version. Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json dec...
OpenSSF/OSV malware advisory MAL-2026-11366 blocks this version. Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json dec...
OpenSSF/OSV malware advisory MAL-2026-11527 blocks this version. streak-metricsaz@1.0.0 presents itself as a calendar/streak math helper but its main entry runs a top-level IIFE that copi...
OpenSSF/OSV malware advisory MAL-2026-11526 blocks this version. package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines...
OpenSSF/OSV malware advisory MAL-2026-11525 blocks this version. package.json declares `postinstall: node test.js`, which auto-executes on `npm install` and performs three attacker-benefi...