npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 625
Updated 28 Oct 2026, 01:56 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6292 blocks this version. package.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payloa...
OpenSSF/OSV malware advisory MAL-2026-6291 blocks this version. package.json declares a postinstall script that runs automatically on `npm install` and performs `require('https').get(...)...
OpenSSF/OSV malware advisory MAL-2026-2491 blocks this version. The package @not-nemo/crypto-tracker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-2491 blocks this version. The package @not-nemo/crypto-tracker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-2491 blocks this version. The package @not-nemo/crypto-tracker was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-4267 blocks this version. On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with...
OpenSSF/OSV malware advisory MAL-2026-4267 blocks this version. On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with...
OpenSSF/OSV malware advisory MAL-2026-4267 blocks this version. On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with...
OpenSSF/OSV malware advisory MAL-2026-5027 blocks this version. The OpenSSF Package Analysis project identified '@neon-i18n/core-ui' @ 99.99.99 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-5540 blocks this version. OSV/OpenSSF confirms @monitoring-lib/error-tracking@9999.0.0 as malicious package MAL-2026-5540. Malicious code in @monitor...
OpenSSF/OSV malware advisory MAL-2026-3602 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3602 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3601 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3601 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3512 blocks this version. The package @mistralai/mistralai-gcp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3512 blocks this version. The package @mistralai/mistralai-gcp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3512 blocks this version. The package @mistralai/mistralai-gcp was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3511 blocks this version. The package @mistralai/mistralai-azure was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3511 blocks this version. The package @mistralai/mistralai-azure was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3511 blocks this version. The package @mistralai/mistralai-azure was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3432 blocks this version. The package @mistralai/mistralai was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3432 blocks this version. The package @mistralai/mistralai was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3432 blocks this version. The package @mistralai/mistralai was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-6509 blocks this version. Package is published as @merceas/anchor but its README, homepage (https://github.com/coral-xyz/anchor#readme), repository,...
OpenSSF/OSV malware advisory MAL-2026-6509 blocks this version. Package is published as @merceas/anchor but its README, homepage (https://github.com/coral-xyz/anchor#readme), repository,...