npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10727 blocks this version. `axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://gith...

OpenSSF/OSV malware advisory MAL-2026-10727 blocks this version. `axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://gith...

The install hook performs concrete, unconsented mutation of a foreign project manifest and injects numerous dependencies in a detached process. No exfiltration was found, but this is suff...

OpenSSF/OSV malware advisory MAL-2026-14198 blocks this version. The package's advertised getTransactions() API invokes an internal loader that reads database.js — a file disguised as a p...

OpenSSF/OSV malware advisory MAL-2026-14196 blocks this version. tfjs-custom-module is a typosquat of the tensorflow/tfjs package. Its package.json declares a postinstall lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-14199 blocks this version. The package advertises itself as generating random transaction data, but its main API method getTransactions() invokes loa...

OpenSSF/OSV malware advisory MAL-2026-12473 blocks this version. table-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-le...

OpenSSF/OSV malware advisory MAL-2026-12473 blocks this version. table-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-le...

OpenSSF/OSV malware advisory MAL-2026-14194 blocks this version. Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook (`no...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

OpenSSF/OSV malware advisory MAL-2026-14186 blocks this version. package.json declares a postinstall hook that runs index.js on install. The script collects the installer's hostname, full...

OpenSSF/OSV malware advisory MAL-2026-14176 blocks this version. On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe (Invoke-WebRequest...

OpenSSF/OSV malware advisory MAL-2026-14188 blocks this version. On require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credential...

OpenSSF/OSV malware advisory MAL-2026-14175 blocks this version. The package's postinstall hook (`package.json` → `node init.js`) runs an installer-side dropper. init.js gates on develope...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14189 blocks this version. Package is presented as a Tailwind CSS utility, but its default export `getPlugin` fetches JSON from a hardcoded bare-IP e...

OpenSSF/OSV malware advisory MAL-2026-14187 blocks this version. scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform s...

OpenSSF/OSV malware advisory MAL-2026-14180 blocks this version. The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attack...

OpenSSF/OSV malware advisory MAL-2026-14183 blocks this version. lodhash-cli is a lodash-typosquat whose main entry (index.js) exports an empty object; the package's only behavior is a po...