npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15570 blocks this version. package.json declares a postinstall hook (`node index.js`) that runs automatically on `npm install`. The shipped index.js...

OpenSSF/OSV malware advisory MAL-2026-15621 blocks this version. gas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to `cgewecke`, source tree mirrored, README pivoted to g...

OpenSSF/OSV malware advisory MAL-2026-15622 blocks this version. package.json declares a preinstall hook ("node preinstall.js || true") that runs unconditionally on npm install. preinstal...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. dist/client.js executes initializeProvider() at module top level, so the code runs whenever a consumer require()s or impor...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15569 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dist/client.js executes initializeProvider() at modu...

OpenSSF/OSV malware advisory MAL-2026-15567 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is published as htps-provider with a README...

OpenSSF/OSV malware advisory MAL-2026-14562 blocks this version. morglog@1.1.0 is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tar...

OpenSSF/OSV malware advisory MAL-2026-14561 blocks this version. The package presents itself as `relative-import-path` (README title, homepage and repository URL point at github.com/marko...

This is concrete install-hook abuse: an npm postinstall mutates the foreign Codex control surface and executes remote shell content. The relay-driven bypass retry materially increases the...

The package has a concrete automatic install-time persistence mechanism that mutates a foreign project and causes ongoing external reporting. The absence of direct token transmission does...

The package combines an automatic lifecycle hook, broad host-agent configuration writes, injected agent instructions, and runtime self-updating through a fresh global install. The global-...

This is a concrete, unconsented postinstall modification of a foreign GitHub Actions control surface with network behavior. It meets the install-hook abuse blocking policy.

The automatic postinstall and normal startup paths modify dependencies and the host system, including privileged package-manager attempts. The package also automatically maintains hooks i...

The package has an automatic install-time hook that installs and executes a separate Python artifact in the user's home directory. That unconsented external payload installation is concre...