npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14059 blocks this version. On `npm install`, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWO...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-14060 blocks this version. The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the...

OpenSSF/OSV malware advisory MAL-2026-11043 blocks this version. The npm package `supplyhub` is a credential / SSH-key stealer. Its `package.json` declares a `postinstall` lifecycle hook...

OpenSSF/OSV malware advisory MAL-2026-14058 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball stages an obfuscated JavaScript payload...

OpenSSF/OSV malware advisory MAL-2026-14057 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js shells out vi...

OpenSSF/OSV malware advisory MAL-2026-14055 blocks this version. The package declares a preinstall lifecycle script (preinstall.js) that reads a hex-encoded command from preinstall.json,...

Source inspection confirms an import-time, targeted browser-disruption payload. The lack of install hooks does not mitigate runtime protestware.

This is concrete import-time installation and manifest mutation of a different registry package, not a user-invoked update command. Absence of npm lifecycle hooks does not mitigate the ru...

This is concrete unconsented import-time mutation of a consumer project, directed at a package name different from the reviewed package. The documented updater claims it installs fca-nx,...