npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14134 blocks this version. On `npm install`, the package's preinstall hook runs `node beacon.js`, which collects host identity (os.hostname(), os.use...

OpenSSF/OSV malware advisory MAL-2026-14138 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-14139 blocks this version. The package declares `preinstall: "node index.js"`, which fires automatically on `npm install`. index.js collects host ide...

OpenSSF/OSV malware advisory MAL-2026-14137 blocks this version. Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2wo...

OpenSSF/OSV malware advisory MAL-2026-14135 blocks this version. The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install,...

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-14122 blocks this version. index.js unconditionally requires./_perf.js on load. _perf.js reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, ~/.aws/...

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-14113 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14113 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14109 blocks this version. The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires _perf.js, which on load re...

OpenSSF/OSV malware advisory MAL-2026-14112 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14112 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14105 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14102 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14102 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14102 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...