npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14302 blocks this version. ai-texts-utils@1.0.3 declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball....

The manifest contains a concrete install-time supply-chain action outside its own package directory, with no package functionality to justify it. This is malicious installation behavior r...

The explicit preinstall hook performs an unconsented secondary package installation. This is concrete install-hook abuse even though the package itself contains no direct exfiltration or...

The package contains a concrete, remote-controlled and unconsented action against users' WhatsApp accounts during ordinary runtime. Its install hook is benign, but does not mitigate the r...

OpenSSF/OSV malware advisory MAL-2026-14216 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares `postinstall: node apps`, whic...

The install-time decryption and detached execution chain is concrete arbitrary-code execution behavior, not a benign static primitive. Absence of the staged file does not neutralize the m...

OpenSSF/OSV malware advisory MAL-2026-14300 blocks this version. The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hoo...

OpenSSF/OSV malware advisory MAL-2026-14301 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package advertises EVM address validation but pe...

The digest check limits transport tampering but does not mitigate the package's explicit purpose of bypassing OS trust warnings for an unsigned remote binary. This is concrete malicious i...

OpenSSF/OSV malware advisory MAL-2026-14299 blocks this version. The package ships multiple components consistent with an install-time credential harvest and exfiltration pipeline. script...

OpenSSF/OSV malware advisory MAL-2026-14298 blocks this version. The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-...

OpenSSF/OSV malware advisory MAL-2026-13392 blocks this version. The package's main module (cdp_inject.js) runs on require. It disables TLS certificate verification process-wide (process....

OpenSSF/OSV malware advisory MAL-2026-10462 blocks this version. Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code...

OpenSSF/OSV malware advisory MAL-2026-14297 blocks this version. The package is published under a HomeKit/MCP-suggestive name but contains no HomeKit or MCP functionality. lib/report.js r...

OpenSSF/OSV malware advisory MAL-2026-10637 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. mc-reg advertises itself as a Cosmos chain-registry...

OpenSSF/OSV malware advisory MAL-2026-14288 blocks this version. dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin...

OpenSSF/OSV malware advisory MAL-2026-14289 blocks this version. dist/index.js appends a heavily obfuscated obfuscator.io-style payload (string array _0x240a of length 303, decoder _0x496...

OpenSSF/OSV malware advisory MAL-2026-14286 blocks this version. dist/index.js (the package's declared main) contains a heavily obfuscated obfuscator.io-style IIFE appended after the legi...

OpenSSF/OSV malware advisory MAL-2026-14285 blocks this version. dist/index.js — the package's main/exports entrypoint — presents ~200 lines of TypeScript-compiled SDK facade followed by...

OpenSSF/OSV malware advisory MAL-2026-14287 blocks this version. dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints...