npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13898 blocks this version. On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the de...

OpenSSF/OSV malware advisory MAL-2026-13897 blocks this version. Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinst...

OpenSSF/OSV malware advisory MAL-2026-13896 blocks this version. On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict...

OpenSSF/OSV malware advisory MAL-2026-13895 blocks this version. The package's postinstall script and its main entrypoint (index.js, byte-identical to callback.js) fetch four tarballs (mh...

OpenSSF/OSV malware advisory MAL-2026-13894 blocks this version. The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches...

OpenSSF/OSV malware advisory MAL-2026-13893 blocks this version. package.json postinstall runs callback.js, and index.js (declared main) is byte-identical, so both `npm install` and any `...

OpenSSF/OSV malware advisory MAL-2026-13892 blocks this version. The package's postinstall script executes callback.js, which downloads four tarballs (mhddos, pyroxy-full, impacket, multi...

OpenSSF/OSV malware advisory MAL-2026-13891 blocks this version. On install, callback.js (also present as index.js and wired as the postinstall hook) downloads four Python tarballs (mhddo...

OpenSSF/OSV malware advisory MAL-2026-13889 blocks this version. The package's postinstall (scripts.postinstall: node callback.js) collects host identity and environment fingerprint (outp...

OpenSSF/OSV malware advisory MAL-2026-13888 blocks this version. Package presents itself as an n8n community utility node, but the shipped node file (nodes/PwnNode.node.js) is a 213-byte...

OpenSSF/OSV malware advisory MAL-2026-13887 blocks this version. The package presents itself as an n8n community node (`n8n-nodes-utils-helper-d`) but its actual on-install behavior is un...

OpenSSF/OSV malware advisory MAL-2026-13886 blocks this version. The npm package's postinstall script (callback.js) resolves the user's Python site-packages directory and downloads a tarb...

OpenSSF/OSV malware advisory MAL-2026-13885 blocks this version. Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node (nodes/PwnNode.node.js...

OpenSSF/OSV malware advisory MAL-2026-13884 blocks this version. The package advertises itself as an n8n utility helper and registers a trivial stub node (nodes/PwnNode.node.js), but its...

OpenSSF/OSV malware advisory MAL-2026-13883 blocks this version. The package's postinstall hook (`node callback.js`) fetches three tarballs (mhddos, pyroxy-full, impacket) from https://ja...

OpenSSF/OSV malware advisory MAL-2026-13770 blocks this version. @telekom-ods/react-ui-kit@2.6.9 ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner....

OpenSSF/OSV malware advisory MAL-2026-13882 blocks this version. package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js shells out via chil...

OpenSSF/OSV malware advisory MAL-2026-13881 blocks this version. On `npm install`, the package's preinstall hook executes index.js, which collects installer identity and host information...

OpenSSF/OSV malware advisory MAL-2026-13881 blocks this version. On `npm install`, the package's preinstall hook executes index.js, which collects installer identity and host information...

OpenSSF/OSV malware advisory MAL-2026-13815 blocks this version. Package contains a single index.html declared as `main` that impersonates a Cloudflare 'Just a moment…' verification page,...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...