npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14281 blocks this version. The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been alte...

OpenSSF/OSV malware advisory MAL-2026-14282 blocks this version. lib/Mutex.js contains a hidden branch inside runExclusive() that, when a callback object carries a meta.jobId whose sha256...

OpenSSF/OSV malware advisory MAL-2026-14284 blocks this version. The package's CLI entry (index.js) launches a Python payload (pointer.py) that registers global keyboard hooks, polls the...

OpenSSF/OSV malware advisory MAL-2026-14279 blocks this version. On `npm install`, the package's postinstall lifecycle script collects installer host identifiers (hostname, platform, arch...

OpenSSF/OSV malware advisory MAL-2026-14276 blocks this version. The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptograp...

OpenSSF/OSV malware advisory MAL-2026-14277 blocks this version. The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a to...

OpenSSF/OSV malware advisory MAL-2026-14275 blocks this version. package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileS...

OpenSSF/OSV malware advisory MAL-2026-14277 blocks this version. The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a to...

OpenSSF/OSV malware advisory MAL-2026-14273 blocks this version. The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of...

OpenSSF/OSV malware advisory MAL-2026-14270 blocks this version. The package installs a global keyboard hook (keyboard.add_hotkey on ctrl+c), polls the system clipboard every 300ms via py...

OpenSSF/OSV malware advisory MAL-2026-14271 blocks this version. The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JS...

OpenSSF/OSV malware advisory MAL-2026-14267 blocks this version. On npm install, the package's postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, Node....

OpenSSF/OSV malware advisory MAL-2026-14269 blocks this version. The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSync(BI...

OpenSSF/OSV malware advisory MAL-2026-14264 blocks this version. package.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.c...

OpenSSF/OSV malware advisory MAL-2026-14265 blocks this version. package.json declares `"postinstall": "sudo node install.js"`, escalating to root on `npm install`. install.js is heavily...

OpenSSF/OSV malware advisory MAL-2026-14266 blocks this version. Package published as `electron-sessions` advertises itself as generic 'Session utilities' but ships a single 1.18MB heavil...

OpenSSF/OSV malware advisory MAL-2026-13342 blocks this version. index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (load...

OpenSSF/OSV malware advisory MAL-2026-14268 blocks this version. package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppa...

OpenSSF/OSV malware advisory MAL-2026-14262 blocks this version. The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hos...

OpenSSF/OSV malware advisory MAL-2026-14258 blocks this version. The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses creat...