npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 646
Updated 27 Oct 2026, 09:59 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10999 blocks this version. The package impersonates the n8n task-runner subsystem but its shipped n8n node (MyNode.js) is a no-op stub whose execute(...
OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...
OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...
OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...
OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...
OpenSSF/OSV malware advisory MAL-2026-11041 blocks this version. The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host iden...
OpenSSF/OSV malware advisory MAL-2026-11124 blocks this version. On `npm install`, the package's postinstall hook (`node test.js`) executes an attacker-controlled workflow against the ins...
OpenSSF/OSV malware advisory MAL-2026-11125 blocks this version. On npm install, the package's postinstall hook (`node test.js`) executes two payloads against the installer host. First, i...
OpenSSF/OSV malware advisory MAL-2026-11129 blocks this version. package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, te...
OpenSSF/OSV malware advisory MAL-2026-11128 blocks this version. app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on `npm install` through a `pos...
OpenSSF/OSV malware advisory MAL-2026-11130 blocks this version. The package's main file index.js is a heavily obfuscated (obfuscator.io RC4+base64 string-array) module whose top-level II...
OpenSSF/OSV malware advisory MAL-2026-11131 blocks this version. package.json declares `preinstall: node index.js`, so `npm install basic-vite` auto-executes index.js. The script collects...
OpenSSF/OSV malware advisory MAL-2026-11126 blocks this version. package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes from_str_2() and from_str_...
OpenSSF/OSV malware advisory MAL-2026-11123 blocks this version. The npm package `@yancyyu/agentcli` ships a Feishu/Lark credential stealer. An auto-started telemetry worker (`src/main/te...
OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...
OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...
OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...
OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...