npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

This is concrete, hidden, remote-controlled unauthorized account mutation during normal package use. The absence of install hooks does not mitigate the runtime behavior.

OpenSSF/OSV malware advisory MAL-2026-14354 blocks this version. kelly-sizing@0.1.1 ships a postinstall script (install-check.cjs) that fetches a JSON config from pm-trading-dev-tools-be....

OpenSSF/OSV malware advisory MAL-2026-14355 blocks this version. The package's postinstall.js script executes automatically on npm install and collects host identity plus environment vari...

The benign engine check does not explain the obfuscated runtime mutation. Concealed third-party branding injected into user messages is concrete, non-consensual payload manipulation.

OpenSSF/OSV malware advisory MAL-2026-14353 blocks this version. All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname,...

OpenSSF/OSV malware advisory MAL-2026-14353 blocks this version. All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname,...

Source directly shows a cashout flow that ignores supplied beneficiary configuration and targets a fixed account, which is concrete fund-diversion behavior. The install hook further mutat...

OpenSSF/OSV malware advisory MAL-2026-6571 blocks this version. react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP e...

OpenSSF/OSV malware advisory MAL-2026-6571 blocks this version. react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP e...

OpenSSF/OSV malware advisory MAL-2026-6571 blocks this version. react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP e...

OpenSSF/OSV malware advisory MAL-2024-2871 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2024-2871 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2024-2871 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-14347 blocks this version. On any require()/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public...