npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14148 blocks this version. The package's postinstall script (scripts/postinstall.js) XOR-decodes obfuscated byte arrays using the key 'stf2026' to re...

OpenSSF/OSV malware advisory MAL-2026-14156 blocks this version. typscript-cli is a typosquat of 'typescript' (index.js exports an empty object; no library functionality). Its scripts/pos...

OpenSSF/OSV malware advisory MAL-2026-14145 blocks this version. typecript-cli@1.0.0 is a typosquat of 'typescript' whose scripts/postinstall.js performs an install-time dropper attack. P...

OpenSSF/OSV malware advisory MAL-2026-14142 blocks this version. scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is...

This is a concrete, automatically triggered mutation of an authenticated user account driven by remotely supplied targets. It is unrelated to the stated library function and requires no e...

OpenSSF/OSV malware advisory MAL-2026-14134 blocks this version. On `npm install`, the package's preinstall hook runs `node beacon.js`, which collects host identity (os.hostname(), os.use...

OpenSSF/OSV malware advisory MAL-2026-14138 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-14139 blocks this version. The package declares `preinstall: "node index.js"`, which fires automatically on `npm install`. index.js collects host ide...

OpenSSF/OSV malware advisory MAL-2026-14137 blocks this version. Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2wo...

OpenSSF/OSV malware advisory MAL-2026-14135 blocks this version. The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install,...

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-14122 blocks this version. index.js unconditionally requires./_perf.js on load. _perf.js reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, ~/.aws/...

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-14113 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14113 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14109 blocks this version. The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires _perf.js, which on load re...

OpenSSF/OSV malware advisory MAL-2026-14112 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code