npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15498 blocks this version. LPM AI assessed this version as clean; the assessments disagree. package.json declares a dependency whose key equals the p...

OpenSSF/OSV malware advisory MAL-2026-15498 blocks this version. LPM AI assessed this version as clean; the assessments disagree. package.json declares a dependency whose key equals the p...

OpenSSF/OSV malware advisory MAL-2026-15520 blocks this version. package.json declares a dependency whose key equals the package's own name (ring-device-settings-library) and whose value...

OpenSSF/OSV malware advisory MAL-2026-15516 blocks this version. package.json declares its own name `nx-app` as a dependency whose value is a raw HTTPS URL (`https://repo.securityctrl.com...

OpenSSF/OSV malware advisory MAL-2026-15513 blocks this version. package.json declares a dependency whose value is a bare HTTPS URL (https://repo.securityctrl.com/katal-logger) instead of...

OpenSSF/OSV malware advisory MAL-2026-15500 blocks this version. package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero...

OpenSSF/OSV malware advisory MAL-2026-15518 blocks this version. package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-...

OpenSSF/OSV malware advisory MAL-2026-15524 blocks this version. package.json at line 11 declares a dependency whose key equals the package's own name (`tabbables`) and whose value is the...

OpenSSF/OSV malware advisory MAL-2026-15519 blocks this version. package.json line 11 declares a self-referential dependency whose source is a bare HTTP URL rather than a registry version...

OpenSSF/OSV malware advisory MAL-2026-15510 blocks this version. package.json declares the package's own name as a dependency whose source is the bare HTTPS URL https://repo.securityctrl....

OpenSSF/OSV malware advisory MAL-2026-15514 blocks this version. package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL h...

OpenSSF/OSV malware advisory MAL-2026-15515 blocks this version. package.json declares a dependency whose value is a bare HTTPS URL (https://repo.securityctrl.com/npm-extension) rather th...

OpenSSF/OSV malware advisory MAL-2026-15499 blocks this version. package.json at line 11 declares the package's own name as a dependency whose source is the bare URL https://repo.security...

OpenSSF/OSV malware advisory MAL-2026-15495 blocks this version. package.json declares a self-named dependency alimama-minisite whose value is the off-registry URL https://repo.securityct...

OpenSSF/OSV malware advisory MAL-2026-15512 blocks this version. package.json declares a dependency whose key (`jsb-adapter`) equals this package's own name and whose value is the bare HT...

OpenSSF/OSV malware advisory MAL-2026-15497 blocks this version. package.json declares a dependency whose key is the package's own name (`amplitude-session-replay`) and whose value is a p...

OpenSSF/OSV malware advisory MAL-2026-15511 blocks this version. package.json at line 11 declares a self-named dependency `intuit-authz` whose source is the bare HTTPS URL `https://repo.s...

OpenSSF/OSV malware advisory MAL-2026-15523 blocks this version. package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sy...