npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13823 blocks this version. Package mnmobicom@1.0.0 was scanned with 2 files and no static or behavioral findings were produced. No lifecycle scripts,...

OpenSSF/OSV malware advisory MAL-2026-13826 blocks this version. The tarball contains just index.html and package.json (main: index.html). index.html mimics a Cloudflare Turnstile challen...

OpenSSF/OSV malware advisory MAL-2026-13799 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package contains a single index.html file declar...

OpenSSF/OSV malware advisory MAL-2026-13811 blocks this version. The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page...

OpenSSF/OSV malware advisory MAL-2026-13838 blocks this version. Package contains only package.json and index.html, with main pointing at index.html. The HTML impersonates a Cloudflare 'J...

OpenSSF/OSV malware advisory MAL-2026-13837 blocks this version. Package unitel3@1.0.0 contains 2 files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

OpenSSF/OSV malware advisory MAL-2026-13785 blocks this version. Package's main entry is index.html, a page styled as a Cloudflare Turnstile challenge. The inline script is obfuscator.io-...

OpenSSF/OSV malware advisory MAL-2026-13800 blocks this version. Package cvvkshuelwiu@1.0.0 contains 2 files with no a static rule matches and no traced behaviors of concern. No install-t...

OpenSSF/OSV malware advisory MAL-2026-13830 blocks this version. The package contains only index.html (declared as main in package.json) and no JavaScript entry point, lifecycle scripts,...

OpenSSF/OSV malware advisory MAL-2026-13839 blocks this version. Package vczxijghsvizu4@1.0.0 contains 2 files with no a static rule matches and no traced behavior indicating exfiltration...

OpenSSF/OSV malware advisory MAL-2026-13797 blocks this version. The tarball contains only index.html (declared as package.json main) and no JavaScript, no lifecycle scripts, and no Node-...

OpenSSF/OSV malware advisory MAL-2026-13814 blocks this version. The tarball contains a single file, index.html, declared as the package `main`. The HTML renders a Cloudflare Turnstile-th...

OpenSSF/OSV malware advisory MAL-2026-13842 blocks this version. Package vlbhvgovbbhfab@1.0.0 contains 2 files. No install-time lifecycle scripts, exfiltration primitives, hardcoded netwo...

OpenSSF/OSV malware advisory MAL-2026-13765 blocks this version. Package name 'lines-columns' closely resembles the popular 'lines-and-columns' package, and the README instructs users to...

OpenSSF/OSV malware advisory MAL-2026-13819 blocks this version. A a static rule matched on keyword co-occurrence (ping, GET, id) across widely separated lines in lib/Utils/generics.js. T...

OpenSSF/OSV malware advisory MAL-2026-13827 blocks this version. Package mobicwkgjmx@1.0.0 contains only two scanned files and no static or traced findings indicating credential access, i...

OpenSSF/OSV malware advisory MAL-2026-13825 blocks this version. The package contains a single file, index.html, which is also declared as the package main. The HTML presents a Cloudflare...

OpenSSF/OSV malware advisory MAL-2026-13843 blocks this version. The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment...' verification page. The...

OpenSSF/OSV malware advisory MAL-2026-13816 blocks this version. The package ships a single HTML file that impersonates Cloudflare's 'Just a moment...' interstitial. On Turnstile widget c...

OpenSSF/OSV malware advisory MAL-2026-13794 blocks this version. The tarball contains only package.json and index.html. package.json declares main: index.html and no lifecycle scripts (pr...