npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14490 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14512 blocks this version. dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes `eval(atob('<~39KB base64>'))` at...

OpenSSF/OSV malware advisory MAL-2026-14559 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14490 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-12221 blocks this version. The package impersonates @tailwindcss/forms: package.json declares the name `tailwind-custom-forms` while the repository f...

OpenSSF/OSV malware advisory MAL-2026-12221 blocks this version. The package impersonates @tailwindcss/forms: package.json declares the name `tailwind-custom-forms` while the repository f...

OpenSSF/OSV malware advisory MAL-2026-14512 blocks this version. dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes `eval(atob('<~39KB base64>'))` at...

OpenSSF/OSV malware advisory MAL-2026-6358 blocks this version. babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env blo...

OpenSSF/OSV malware advisory MAL-2026-14499 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14490 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14500 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-14497 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-14493 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-14495 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-14502 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14501 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14494 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...

OpenSSF/OSV malware advisory MAL-2026-6358 blocks this version. babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env blo...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...