npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 624
Updated 28 Oct 2026, 01:20 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3844 blocks this version. The package @openclaw-cn/toutiao-ops was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3842 blocks this version. The package @openclaw-cn/feishu was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3843 blocks this version. The package @openclaw-cn/libsignal was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3841 blocks this version. The package @openclaw-cn/cli was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6123 blocks this version. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01d...
OpenSSF/OSV malware advisory MAL-2026-6123 blocks this version. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01d...
OpenSSF/OSV malware advisory MAL-2026-6123 blocks this version. On `require('@onum-releases/auth')`, index.js reads `os.hostname()` and issues an HTTP GET to `auth.<hostname>.200majoeu01d...
OpenSSF/OSV malware advisory MAL-2026-6122 blocks this version. On require(), index.js reads os.hostname(), embeds it as a subdomain label under a Burp Collaborator (oastify.com) host, an...
OpenSSF/OSV malware advisory MAL-2026-6122 blocks this version. On require(), index.js reads os.hostname(), embeds it as a subdomain label under a Burp Collaborator (oastify.com) host, an...
OpenSSF/OSV malware advisory MAL-2026-6122 blocks this version. On require(), index.js reads os.hostname(), embeds it as a subdomain label under a Burp Collaborator (oastify.com) host, an...
OpenSSF/OSV malware advisory MAL-2026-6127 blocks this version. On require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.<hostname>.200majoeu01dk0...
OpenSSF/OSV malware advisory MAL-2026-6127 blocks this version. On require('@onum-releases/utils'), index.js reads os.hostname() and issues an HTTP GET to 'utils.<hostname>.200majoeu01dk0...
OpenSSF/OSV malware advisory MAL-2026-6125 blocks this version. On import, index.js reads the installer's machine hostname via os.hostname(), embeds it as a subdomain of a hardcoded *.oas...
OpenSSF/OSV malware advisory MAL-2026-6125 blocks this version. On import, index.js reads the installer's machine hostname via os.hostname(), embeds it as a subdomain of a hardcoded *.oas...
OpenSSF/OSV malware advisory MAL-2026-6125 blocks this version. On import, index.js reads the installer's machine hostname via os.hostname(), embeds it as a subdomain of a hardcoded *.oas...
OpenSSF/OSV malware advisory MAL-2026-6126 blocks this version. On require()/import, index.js reads os.hostname() and issues an HTTP GET to 'shared-components.<hostname>.200majoeu01dk02xn...
OpenSSF/OSV malware advisory MAL-2026-6126 blocks this version. On require()/import, index.js reads os.hostname() and issues an HTTP GET to 'shared-components.<hostname>.200majoeu01dk02xn...
OpenSSF/OSV malware advisory MAL-2026-6126 blocks this version. On require()/import, index.js reads os.hostname() and issues an HTTP GET to 'shared-components.<hostname>.200majoeu01dk02xn...
OpenSSF/OSV malware advisory MAL-2026-6124 blocks this version. On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastif...
OpenSSF/OSV malware advisory MAL-2026-6124 blocks this version. On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastif...
OpenSSF/OSV malware advisory MAL-2026-6124 blocks this version. On import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.<hostname>.200majoeu01dk02xnjdajro1isojc90y.oastif...
OpenSSF/OSV malware advisory MAL-2026-3257 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...
OpenSSF/OSV malware advisory MAL-2026-6292 blocks this version. package.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payloa...
OpenSSF/OSV malware advisory MAL-2026-6292 blocks this version. package.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payloa...