npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14326 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14325 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10614 blocks this version. Package is published as `postcss-selector-minify` (a word-order permutation of cssnano's widely used `postcss-minify-selec...

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14317 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../p...

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../p...

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../p...

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On any require/import of exam-kit, the main entry ru...

OpenSSF/OSV malware advisory MAL-2026-12186 blocks this version. On require('pfp-forms-insurance-health'), index.js loads _compat.js which immediately invokes a dropper routine. It select...

OpenSSF/OSV malware advisory MAL-2026-5450 blocks this version. The package name impersonates the OpenMRS O3 forms ecosystem (legitimate packages are published under the @openmrs/ scope)....

OpenSSF/OSV malware advisory MAL-2026-5450 blocks this version. The package name impersonates the OpenMRS O3 forms ecosystem (legitimate packages are published under the @openmrs/ scope)....

Source directly implements host-project mutation, plaintext transmission of caller identity data, and a fixed-recipient payout flow. The payout behavior is inconsistent with the public co...

The package contains concrete, stealthy postinstall mutation of the consuming project’s dependency manifest. No network exfiltration is needed for this install-hook supply-chain abuse to...

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

This contains concrete, unconsented runtime account mutation and host-fingerprint exfiltration, not merely package-aligned WhatsApp functionality. The install hook is local-only but does...

OpenSSF/OSV malware advisory MAL-2026-6579 blocks this version. lessload@1.0.1 impersonates the popular `debug` package (replicating its API surface, contributor list, and description as...