This is a work in progress, published on purpose before it is finished. Tonight we are blocking 8 npm packages that the open-source vulnerability database OSV does not list, we found a bug in our own deny-list that left roughly 11,000 known-malicious npm entries under-blocked, and a re-sync to fix it is still running. The real numbers replace the estimates here tomorrow. What we found, and who found it first None of these packages were our discovery. Elastic Security Labs (Ji