npm advisory reports, with evidence.
Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 627
Updated 28 Oct 2026, 03:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-6013 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6007 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5942 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-6010 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5941 blocks this version. OSV/OpenSSF confirms @mastra/braintrust@1.1.4 as malicious package MAL-2026-5941. Malicious code in @mastra/braintrust (npm)
OpenSSF/OSV malware advisory MAL-2026-6000 blocks this version. OSV/OpenSSF confirms @mastra/auth-better-auth@1.0.4 as malicious package MAL-2026-6000. Malicious code in @mastra/auth-bett...
OpenSSF/OSV malware advisory MAL-2026-5999 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5940 blocks this version. OSV/OpenSSF confirms @mastra/auth@1.0.3 as malicious package MAL-2026-5940. Malicious code in @mastra/auth (npm)
OpenSSF/OSV malware advisory MAL-2026-5998 blocks this version. OSV/OpenSSF confirms @mastra/arize@1.2.3 as malicious package MAL-2026-5998. Malicious code in @mastra/arize (npm)
OpenSSF/OSV malware advisory MAL-2026-5939 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...
OpenSSF/OSV malware advisory MAL-2026-5685 blocks this version. OSV/OpenSSF confirms @malwguy/ecto-corsair-whisper-3d2a7c@1.0.0 as malicious package MAL-2026-5685. Malicious code in @malw...
OpenSSF/OSV malware advisory MAL-2026-6328 blocks this version. On `npm install`, the package's preinstall lifecycle hook runs `node index.js`, which collects host identifiers (`os.userIn...
OpenSSF/OSV malware advisory MAL-2026-3679 blocks this version. The package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from...
OpenSSF/OSV malware advisory MAL-2026-3679 blocks this version. The package is advertised as a neutral CLI/MCP wrapper for Hyperliquid, but its distributed code silently routes value from...
OpenSSF/OSV malware advisory MAL-2026-3678 blocks this version. The package's declared main entry (router.js) is an IIFE that runs the moment an installer's code executes `require('8q')`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...
OpenSSF/OSV malware advisory MAL-2026-3677 blocks this version. The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console`...