npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-14805 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14788 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14801 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14794 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14791 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14797 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14800 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14795 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14790 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14799 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14798 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14793 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15508 blocks this version. package.json declares a preinstall lifecycle script that runs `node -e` to invoke `child_process.execSync('curl -s 216.126...

OpenSSF/OSV malware advisory MAL-2026-15506 blocks this version. grafeno-logger@1.0.0 is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs `curl -s...

OpenSSF/OSV malware advisory MAL-2026-15528 blocks this version. package.json declares a dependency whose key equals the package's own name (`axis-datagrid`) and whose source is the bare...

OpenSSF/OSV malware advisory MAL-2026-15545 blocks this version. package.json line 11 declares a dependency whose key equals the package's own name (ux-metrics-client-interaction-subscrib...

OpenSSF/OSV malware advisory MAL-2026-15546 blocks this version. package.json declares a dependency whose key equals this package's own name (`vui-gateway`) and whose source is an off-reg...

OpenSSF/OSV malware advisory MAL-2026-15538 blocks this version. package.json at line 11 declares a dependency whose key equals the package's own name (librastandardlib) and whose value i...

OpenSSF/OSV malware advisory MAL-2026-15543 blocks this version. package.json line 11 declares a dependency whose key equals the package's own name (`prm-bundles`) and whose value is a ba...