Inquiry Regarding Cloudflare Blocking When Submitting npm Malware Reports

[Alanxtl]

🏷️ Discussion Type

Question

Body

Inquiry Regarding Cloudflare Blocking When Submitting npm Malware Reports

Hello npm Security Team,

I am a security researcher who regularly reports malicious packages and suspicious activity on npm. Recently, I have noticed that when I try to submit malware reports through the npm reporting workflow, my requests are blocked by Cloudflare.

I would like to ask whether this behavior is expected, and whether there is any recommended way for researchers like me to avoid being mistakenly blocked while submitting legitimate security reports.

For context, I have been actively reporting malicious packages to npm, and I have already received 48 email confirmations indicating that my submitted reports were reviewed and resolved. This suggests that my reports are legitimate and useful to the ecosystem, so I am concerned that the Cloudflare blocking may prevent me from continuing to submit timely reports.

Could you please help me understand:

1. Why my report submissions may be triggering Cloudflare blocking?
2. Whether my account, IP address, or reporting pattern can be reviewed?
3. Whether there is a preferred channel or allowlisting process for frequent security researchers submitting npm malware reports?
4. What information I should provide to help investigate this issue, such as timestamps, Ray IDs, screenshots, or blocked URLs?

I am happy to provide examples of the Cloudflare block pages, including Ray IDs and submission times, if needed.

Thank you for your time and for your work protecting the npm ecosystem. I would appreciate any guidance that helps ensure legitimate security reports can continue to be submitted smoothly.

Best regards,
Xuetao Li
Github username: Alanxtl
NPM username: m134679102365478
email: "Personal info edited by staff"