npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14482 blocks this version. This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every buil...

OpenSSF/OSV malware advisory MAL-2026-14480 blocks this version. The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml...

OpenSSF/OSV malware advisory MAL-2026-14480 blocks this version. The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml...

OpenSSF/OSV malware advisory MAL-2026-14480 blocks this version. The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml...

OpenSSF/OSV malware advisory MAL-2026-14463 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14449 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14447 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14464 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14468 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14461 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14470 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14467 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14460 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14454 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14453 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14456 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14452 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14458 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14478 blocks this version. On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../...

OpenSSF/OSV malware advisory MAL-2026-14472 blocks this version. cscasereadserv-paypal@3.4.3 executes a preinstall script that auto-runs on `npm install`. The script collects the installe...