npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-13999 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14014 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13998 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13926 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13925 blocks this version. On require('bcs-compact'), index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at ~/.sui/su...

OpenSSF/OSV malware advisory MAL-2026-13955 blocks this version. The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When r...

OpenSSF/OSV malware advisory MAL-2026-14005 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14005 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-12507 blocks this version. The package declares an `install` lifecycle script that runs `node index.js`, which requires `lib/core.js`; the same modul...

OpenSSF/OSV malware advisory MAL-2026-13932 blocks this version. npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter au...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-13996 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13996 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13996 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-13932 blocks this version. npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter au...