npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14207 blocks this version. The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basena...

OpenSSF/OSV malware advisory MAL-2026-14204 blocks this version. Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo().us...

OpenSSF/OSV malware advisory MAL-2026-14210 blocks this version. On require('sui-graphql-rpc'), index.js loads lib/telemetry.js which reads ~/.gitconfig from the installer's home director...

OpenSSF/OSV malware advisory MAL-2026-14209 blocks this version. On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14212 blocks this version. On invocation, index.js spawns start_tool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute...

OpenSSF/OSV malware advisory MAL-2026-14213 blocks this version. The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload (pointer.py) th...

OpenSSF/OSV malware advisory MAL-2026-10428 blocks this version. The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. in...

OpenSSF/OSV malware advisory MAL-2026-10428 blocks this version. The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. in...

OpenSSF/OSV malware advisory MAL-2026-14211 blocks this version. sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailw...

OpenSSF/OSV malware advisory MAL-2026-14211 blocks this version. sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailw...

OpenSSF/OSV malware advisory MAL-2026-14211 blocks this version. sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailw...

OpenSSF/OSV malware advisory MAL-2026-14208 blocks this version. index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload conc...

OpenSSF/OSV malware advisory MAL-2026-14214 blocks this version. Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json ma...

OpenSSF/OSV malware advisory MAL-2026-14214 blocks this version. Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json ma...

OpenSSF/OSV malware advisory MAL-2026-14203 blocks this version. The package's postinstall lifecycle hook (package.json declares postinstall=node scripts/setup.js) decodes base64-encoded...

OpenSSF/OSV malware advisory MAL-2026-14200 blocks this version. The package advertises itself as a logger (README and type definitions copied wholesale from pinojs/pino) but its exported...

OpenSSF/OSV malware advisory MAL-2026-13613 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. big-tss@5.0.5 impersonates the popular big.js arbitr...