npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...

OpenSSF/OSV malware advisory MAL-2026-14404 blocks this version. Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do w...

OpenSSF/OSV malware advisory MAL-2026-14404 blocks this version. Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do w...

OpenSSF/OSV malware advisory MAL-2026-13456 blocks this version. santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) re...

OpenSSF/OSV malware advisory MAL-2026-14440 blocks this version. web-advertising@999.9.16 declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install....

OpenSSF/OSV malware advisory MAL-2026-14440 blocks this version. web-advertising@999.9.16 declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install....

OpenSSF/OSV malware advisory MAL-2026-14438 blocks this version. package.json declares `preinstall: node index.js`, so `npm install` automatically runs index.js. index.js reads os.hostnam...

OpenSSF/OSV malware advisory MAL-2026-14434 blocks this version. The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS server...

OpenSSF/OSV malware advisory MAL-2026-6497 blocks this version. chai-as-synced@7.0.9 impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout...

OpenSSF/OSV malware advisory MAL-2026-14435 blocks this version. The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, a...

OpenSSF/OSV malware advisory MAL-2026-14428 blocks this version. consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, ho...

OpenSSF/OSV malware advisory MAL-2026-14433 blocks this version. The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hos...

OpenSSF/OSV malware advisory MAL-2026-14437 blocks this version. On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current work...

OpenSSF/OSV malware advisory MAL-2026-14430 blocks this version. hydration-dim-ui@1.0.0 presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import ti...

OpenSSF/OSV malware advisory MAL-2026-14432 blocks this version. kelly-stake-sizing@0.1.1 declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from h...

OpenSSF/OSV malware advisory MAL-2026-14439 blocks this version. secret-key-totp@1.5.1 declares a postinstall hook (`node./index.js --setup`) that executes a credential stealer and droppe...

OpenSSF/OSV malware advisory MAL-2026-14410 blocks this version. The package registers a preinstall hook (node index.js) that runs on npm install and harvests installer-side data: os.host...

OpenSSF/OSV malware advisory MAL-2026-14425 blocks this version. Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs `node lib/core.js --setup` as a po...

OpenSSF/OSV malware advisory MAL-2026-14425 blocks this version. Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs `node lib/core.js --setup` as a po...

OpenSSF/OSV malware advisory MAL-2026-14425 blocks this version. Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs `node lib/core.js --setup` as a po...