npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14343 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. chai-as-soul@2.3.5 is a typosquat/repackage of pino:...

OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...

OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...

OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...

OpenSSF/OSV malware advisory MAL-2026-14321 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14319 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14319 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-13348 blocks this version. lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a s...

OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...

OpenSSF/OSV malware advisory MAL-2026-14330 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14330 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-14320 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13451 blocks this version. nms-dashboard-js@9.9.11 declares an npm install lifecycle hook (`scripts.install: "node index.js"`) that unconditionally r...

OpenSSF/OSV malware advisory MAL-2026-10637 blocks this version. mc-reg advertises itself as a Cosmos chain-registry data package (README shows chain-registry-style `assets`/`chains`/`ibc...

OpenSSF/OSV malware advisory MAL-2026-10637 blocks this version. mc-reg advertises itself as a Cosmos chain-registry data package (README shows chain-registry-style `assets`/`chains`/`ibc...