npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12359 blocks this version. The package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/H...

OpenSSF/OSV malware advisory MAL-2026-14234 blocks this version. The package's scripts/postinstall.js runs automatically on npm install and imports child_process alongside http.request wi...

OpenSSF/OSV malware advisory MAL-2026-14238 blocks this version. The package's postinstall script runs automatically on npm install and collects host identifiers (os.hostname(), platform,...

OpenSSF/OSV malware advisory MAL-2026-14237 blocks this version. On npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.pla...

OpenSSF/OSV malware advisory MAL-2026-14233 blocks this version. code-assist-mcp@1.0.0 runs a postinstall lifecycle script that collects host identifiers (hostname, platform, arch, Node v...

OpenSSF/OSV malware advisory MAL-2026-14232 blocks this version. The package's postinstall script runs on `npm install` and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.t...

OpenSSF/OSV malware advisory MAL-2026-14231 blocks this version. chromecast-webdriver-cli@1.0.0 runs a postinstall lifecycle script that collects host metadata (os.hostname(), platform, a...

OpenSSF/OSV malware advisory MAL-2026-14230 blocks this version. chrome-enterprise-premium-mcp ships a postinstall lifecycle script that fires automatically on `npm install` and POSTs ins...

OpenSSF/OSV malware advisory MAL-2026-14228 blocks this version. The package's postinstall script runs automatically on `npm install` and collects host identifiers from the installer mach...

OpenSSF/OSV malware advisory MAL-2026-14227 blocks this version. This npm package uses the name `bazelisk`, colliding with Google's bazelbuild/bazelisk project (referenced in the tarball'...

OpenSSF/OSV malware advisory MAL-2026-14239 blocks this version. gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher (`gaarf`)...

OpenSSF/OSV malware advisory MAL-2026-14236 blocks this version. The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers (os.h...

OpenSSF/OSV malware advisory MAL-2026-14226 blocks this version. plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a c...

OpenSSF/OSV malware advisory MAL-2026-14225 blocks this version. The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET t...

OpenSSF/OSV malware advisory MAL-2026-14225 blocks this version. The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET t...

OpenSSF/OSV malware advisory MAL-2026-14219 blocks this version. The package's lib/report.js requires child_process, fs, https, and os at the top of the module and constructs an HTTPS POS...

OpenSSF/OSV malware advisory MAL-2026-14224 blocks this version. streak-metric-test@1.0.0 ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level a...

OpenSSF/OSV malware advisory MAL-2026-14220 blocks this version. The npm package solidity-hold@2.0.1 impersonates the popular pino logger: the README badges and lib/ source tree are copie...

OpenSSF/OSV malware advisory MAL-2026-14221 blocks this version. ssb-test-package@1.0.0 is a dependency-confusion proof-of-concept. package.json declares `preinstall: node poc.js`, and po...

OpenSSF/OSV malware advisory MAL-2026-14218 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Unscoped npm package 'mapkit-loader' impersonates th...