npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14378 blocks this version. package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hos...

OpenSSF/OSV malware advisory MAL-2026-14377 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, p...

OpenSSF/OSV malware advisory MAL-2026-14366 blocks this version. index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameW...

OpenSSF/OSV malware advisory MAL-2026-14365 blocks this version. The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/ra...

OpenSSF/OSV malware advisory MAL-2026-14364 blocks this version. The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket...

OpenSSF/OSV malware advisory MAL-2026-14363 blocks this version. The package consists of a minimal HTML wrapper (index.html) whose only behavior is to fetch content from a hardcoded, unpi...

OpenSSF/OSV malware advisory MAL-2026-14362 blocks this version. index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL https://bitbucket.org/p2p-alt-public...

OpenSSF/OSV malware advisory MAL-2026-14366 blocks this version. index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameW...

OpenSSF/OSV malware advisory MAL-2026-14365 blocks this version. The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/ra...

OpenSSF/OSV malware advisory MAL-2026-14364 blocks this version. The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket...

OpenSSF/OSV malware advisory MAL-2026-14363 blocks this version. The package consists of a minimal HTML wrapper (index.html) whose only behavior is to fetch content from a hardcoded, unpi...

OpenSSF/OSV malware advisory MAL-2026-14362 blocks this version. index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL https://bitbucket.org/p2p-alt-public...

OpenSSF/OSV malware advisory MAL-2026-14371 blocks this version. The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball shi...

OpenSSF/OSV malware advisory MAL-2026-14379 blocks this version. Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and...

OpenSSF/OSV malware advisory MAL-2026-14379 blocks this version. Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and...

OpenSSF/OSV malware advisory MAL-2026-14379 blocks this version. Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and...

OpenSSF/OSV malware advisory MAL-2026-12418 blocks this version. src/normalize-options.js is heavily obfuscated (RC4-decoded string array, hex-numeric literals, rotating string-array shuf...

OpenSSF/OSV malware advisory MAL-2026-10516 blocks this version. On npm install, the package's postinstall hook runs install-check.cjs, which fetches a JSON config from https://jipred.ver...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...