npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14014 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13998 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13926 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13925 blocks this version. On require('bcs-compact'), index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at ~/.sui/su...

OpenSSF/OSV malware advisory MAL-2026-13955 blocks this version. The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When r...

OpenSSF/OSV malware advisory MAL-2026-14005 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14005 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-12507 blocks this version. The package declares an `install` lifecycle script that runs `node index.js`, which requires `lib/core.js`; the same modul...

OpenSSF/OSV malware advisory MAL-2026-13932 blocks this version. npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter au...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-13996 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13996 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13996 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13932 blocks this version. npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter au...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-6085 blocks this version. @hotcappuccino/nodepull@1.0.0 ships a single `index.js` (the package's declared `main`) that is wrapped in an obfuscator.io...

OpenSSF/OSV malware advisory MAL-2026-13932 blocks this version. npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter au...

OpenSSF/OSV malware advisory MAL-2026-14029 blocks this version. axios-fast@1.0.1 declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire...