npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 617
Updated 26 Oct 2026, 16:20 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11366 blocks this version. Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json dec...
OpenSSF/OSV malware advisory MAL-2026-11366 blocks this version. Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json dec...
OpenSSF/OSV malware advisory MAL-2026-11366 blocks this version. Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json dec...
OpenSSF/OSV malware advisory MAL-2026-11527 blocks this version. streak-metricsaz@1.0.0 presents itself as a calendar/streak math helper but its main entry runs a top-level IIFE that copi...
OpenSSF/OSV malware advisory MAL-2026-11526 blocks this version. package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines...
OpenSSF/OSV malware advisory MAL-2026-11525 blocks this version. package.json declares `postinstall: node test.js`, which auto-executes on `npm install` and performs three attacker-benefi...
OpenSSF/OSV malware advisory MAL-2026-11096 blocks this version. On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e92506...
OpenSSF/OSV malware advisory MAL-2026-11096 blocks this version. On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e92506...
OpenSSF/OSV malware advisory MAL-2026-10981 blocks this version. index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODE_ENV!= 'p...
OpenSSF/OSV malware advisory MAL-2026-11010 blocks this version. index.mjs auto-invokes a _sync() routine at module import. Under Linux with NODE_ENV!= production and access to a WSL /mnt...
OpenSSF/OSV malware advisory MAL-2026-10987 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. react-tabulix-core@0.1.0 declares a preinstall lifec...
OpenSSF/OSV malware advisory MAL-2026-11011 blocks this version. The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavil...
OpenSSF/OSV malware advisory MAL-2026-10936 blocks this version. The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210'...
OpenSSF/OSV malware advisory MAL-2026-10936 blocks this version. The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210'...
OpenSSF/OSV malware advisory MAL-2026-10934 blocks this version. The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published...
OpenSSF/OSV malware advisory MAL-2026-10933 blocks this version. The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by...
OpenSSF/OSV malware advisory MAL-2026-10932 blocks this version. The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by...
OpenSSF/OSV malware advisory MAL-2026-10937 blocks this version. The twilio-serverless package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace publishe...
OpenSSF/OSV malware advisory MAL-2026-10944 blocks this version. The zer0onetencent package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com...
OpenSSF/OSV malware advisory MAL-2026-10941 blocks this version. The aftermath-finance package was published to the npm registry by user 'jet0010001' (maintainer email bremagml0002@gmail....
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...
OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On first invocation of `npx claude-cup` (and on every...
OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...
OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...