npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-14361 blocks this version. On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home d...

The verified install-time chain performs unconsented hosts-file/DNS mutation and drops launch artifacts. This is concrete harmful behavior, not merely a user-invoked installer.

The package executes a bundled native payload at import time, and its embedded credential, exfiltration, and persistence indicators establish a concrete malicious chain. Absence of an npm...

Source inspection confirmed deliberate reviewer/agent manipulation and propagation into generated artifacts. This warrants blocking despite otherwise package-aligned build behavior.

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code