Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Updated 12 Oct 2026, 00:30 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5838 blocks this version. On require, index.js performs an unconditional `http.get` to a unique subdomain of oastify.com (Burp Suite Collaborator out...
OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...
OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...
OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...