npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6716 blocks this version. On `npm install`, the package's `postinstall` script (`node demo-clean.js`) auto-executes two installer-side actions withou...

OpenSSF/OSV malware advisory MAL-2026-14313 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...

OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...

OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...

OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...

OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...

OpenSSF/OSV malware advisory MAL-2026-5611 blocks this version. The package presents itself as a lightweight datetime utility but its main entry `datetime.js` invokes `collect()` from `./...

OpenSSF/OSV malware advisory MAL-2026-14310 blocks this version. package.json declares `"bin": { "node": "./shim.js" }`, which causes npm to place a `node` executable into `node_modules/....

OpenSSF/OSV malware advisory MAL-2026-14310 blocks this version. package.json declares `"bin": { "node": "./shim.js" }`, which causes npm to place a `node` executable into `node_modules/....

OpenSSF/OSV malware advisory MAL-2026-12382 blocks this version. On require() of this package, index.js loads _compat.js which reconstructs destination hostnames from string-split arrays...

OpenSSF/OSV malware advisory MAL-2026-12364 blocks this version. On require, index.js loads _loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose name...

OpenSSF/OSV malware advisory MAL-2026-6568 blocks this version. express-mocha-test@0.0.1 declares a postinstall lifecycle hook that loads the package's main module, which calls fetch() ag...

OpenSSF/OSV malware advisory MAL-2026-6567 blocks this version. The package is published under the name `eslint-commit-parser` but its contents are a verbatim copy of the `supertest` HTTP...

The package’s install hook intentionally delivers and registers an unsigned native payload while circumventing platform download protections. Hash validation does not mitigate the publish...

The only package behavior is an automatic postinstall mutation of the consuming project to add another package. That concrete, unconsented dependency injection warrants blocking.

Direct manifest inspection confirms an install-time command that mutates the consuming project by installing a separate package. No benign package-aligned setup purpose is shown.

The lifecycle hook performs an unconsented install-time mutation outside the package directory. The missing declared entrypoint does not mitigate that concrete behavior.

Direct source inspection confirms an install-time mutation of the consuming project's manifest to add an unrelated dependency. This is concrete malicious supply-chain behavior.

The package contains a concrete postinstall dependency-injection chain against the installer project's package.json. No benign package function or user-invoked setup path justifies this m...