npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14481 blocks this version. The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script in...

OpenSSF/OSV malware advisory MAL-2026-14479 blocks this version. The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every...

OpenSSF/OSV malware advisory MAL-2026-14479 blocks this version. The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every...

OpenSSF/OSV malware advisory MAL-2026-14448 blocks this version. The package's index.html impersonates Google Classroom (title, gstatic favicon, hardcoded student email student111@risd.ed...

OpenSSF/OSV malware advisory MAL-2026-14446 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14450 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14465 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14459 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14462 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14469 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

This is concrete import-time execution of a bundled malicious native payload, not a package-aligned accelerator. No lifecycle hook is needed for the payload to activate when the advertise...

This is concrete package-controlled financial diversion from a user-configured wallet, enabled by default and contradicted by the README. There is no install-time execution, but runtime b...

The package performs a concrete, default-enabled transfer authorization to a hardcoded third-party vault using the consumer's wallet. Disclosure in source and an opt-out do not cure the c...

The source implements an install-time remote native payload chain explicitly designed to evade OS download protections, followed by persistence-like desktop registration. This is concrete...

The package performs an undisclosed, automatic action on the user's authenticated WhatsApp account, concealed in an obfuscated policy module. Its install hook is not the attack vector, bu...

The import-time executable is concrete, unrelated to the package purpose, and contains explicit malware capabilities. No install hook is needed for impact because ordinary application imp...

Source confirms a deliberate GitLens license-bypass and foreign extension overwrite capability. This is concrete malicious behavior despite not being activated by postinstall.

The package contains concrete, automatic, unconsented mutation of outgoing user media metadata. Although the lifecycle hook is benign and no host credential theft was found, the hidden at...

The package executes an opaque, network-capable native binary during ordinary import and detaches it from the host process. The visible JavaScript functionality does not require that binary.

OpenSSF/OSV malware advisory MAL-2026-1383 blocks this version. Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependenc...

OpenSSF/OSV malware advisory MAL-2026-1383 blocks this version. Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependenc...