npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 626
Updated 28 Oct 2026, 02:25 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6510 blocks this version. Package is published under the @merceas scope as `cross-fetch` and reuses the upstream cross-fetch README, homepage (github...
OpenSSF/OSV malware advisory MAL-2026-3510 blocks this version. The package @mesadev/rest was found to contain malicious code.
OpenSSF/OSV malware advisory MAL-2026-3600 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-3599 blocks this version. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
OpenSSF/OSV malware advisory MAL-2026-4171 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5960 blocks this version. OSV/OpenSSF confirms @mastra/posthog@1.0.29 as malicious package MAL-2026-5960. Malicious code in @mastra/posthog (npm)
OpenSSF/OSV malware advisory MAL-2026-5956 blocks this version. OSV/OpenSSF confirms @mastra/mcp-docs-server@1.1.47 as malicious package MAL-2026-5956. Malicious code in @mastra/mcp-docs-...
OpenSSF/OSV malware advisory MAL-2026-5955 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5952 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5953 blocks this version. OSV/OpenSSF confirms @mastra/langsmith@1.2.4 as malicious package MAL-2026-5953. Malicious code in @mastra/langsmith (npm)
OpenSSF/OSV malware advisory MAL-2026-6072 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5954 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5951 blocks this version. OSV/OpenSSF confirms @mastra/inngest@1.5.2 as malicious package MAL-2026-5951. Malicious code in @mastra/inngest (npm)
OpenSSF/OSV malware advisory MAL-2026-5950 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5948 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5949 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5946 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5947 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6015 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5943 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5945 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5944 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6019 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6013 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6007 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...