npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13603 blocks this version. On require of platform-ui-colors, both the declared main lib/telemetry.js and _helpers.js fetch an opaque binary from auth...

OpenSSF/OSV malware advisory MAL-2026-13398 blocks this version. On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/ag...

OpenSSF/OSV malware advisory MAL-2026-13398 blocks this version. On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/ag...

OpenSSF/OSV malware advisory MAL-2026-13605 blocks this version. The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjb...

OpenSSF/OSV malware advisory MAL-2026-13605 blocks this version. The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjb...

OpenSSF/OSV malware advisory MAL-2026-13532 blocks this version. On require() of the package, index.js loads _helpers.js which downloads a platform-specific binary from attacker-controlle...

OpenSSF/OSV malware advisory MAL-2026-13530 blocks this version. On any require/import of this package, index.js loads setup.js, which reassembles four `oob-worker.cf*.workers.dev` hostna...

OpenSSF/OSV malware advisory MAL-2026-13528 blocks this version. The package's main entry (index.js) requires./_ext at module load. _ext.js downloads a platform-specific binary from hardc...

OpenSSF/OSV malware advisory MAL-2026-13527 blocks this version. On require() of the package main, _polyfill.js runs an async bootstrap that reconstructs network destinations from string-...

OpenSSF/OSV malware advisory MAL-2026-13549 blocks this version. dojo-rn-interview@1.0.1 declares a preinstall script that runs index.js on `npm install`. The script collects host identif...

OpenSSF/OSV malware advisory MAL-2026-13475 blocks this version. Package sui-graphql-client@0.1.0 was scanned across 3 files with no a static rule matches and no traced behaviors indicati...

OpenSSF/OSV malware advisory MAL-2026-13475 blocks this version. Package sui-graphql-client@0.1.0 was scanned across 3 files with no a static rule matches and no traced behaviors indicati...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-12004 blocks this version. The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nod...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. cli.js embeds a base64-encoded RSA private key in CO...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and use...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and use...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and use...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and use...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and use...

OpenSSF/OSV malware advisory MAL-2026-13493 blocks this version. cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and use...