npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14029 blocks this version. axios-fast@1.0.1 declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire...

OpenSSF/OSV malware advisory MAL-2026-14031 blocks this version. The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install vi...

OpenSSF/OSV malware advisory MAL-2026-14036 blocks this version. The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONT...

OpenSSF/OSV malware advisory MAL-2026-14036 blocks this version. The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONT...

OpenSSF/OSV malware advisory MAL-2026-14036 blocks this version. The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONT...

OpenSSF/OSV malware advisory MAL-2026-14036 blocks this version. The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONT...

OpenSSF/OSV malware advisory MAL-2026-14036 blocks this version. The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONT...

OpenSSF/OSV malware advisory MAL-2026-14036 blocks this version. The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONT...

OpenSSF/OSV malware advisory MAL-2026-14025 blocks this version. On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload o...

OpenSSF/OSV malware advisory MAL-2026-14027 blocks this version. alelo-services@99.0.0 runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to th...

OpenSSF/OSV malware advisory MAL-2026-14022 blocks this version. alelo-client@99.0.0 is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace (version 99....

OpenSSF/OSV malware advisory MAL-2026-14021 blocks this version. The package's preinstall script (preinstall.js) collects hostname, username, platform, current working directory, and the...

OpenSSF/OSV malware advisory MAL-2026-14020 blocks this version. The package fires attacker-controlled code on `npm install` via both `preinstall.js` and `index.js` (postinstall). preinst...

OpenSSF/OSV malware advisory MAL-2026-14026 blocks this version. alelo-sdk@99.0.0 ships lifecycle scripts that harvest installer data and POST it to a hardcoded bare-IP endpoint (209.99.1...

OpenSSF/OSV malware advisory MAL-2026-14024 blocks this version. The package runs malicious lifecycle scripts on npm install. preinstall.js collects hostname, username, platform, cwd, and...

OpenSSF/OSV malware advisory MAL-2026-14025 blocks this version. On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload o...

OpenSSF/OSV malware advisory MAL-2026-14027 blocks this version. alelo-services@99.0.0 runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to th...

OpenSSF/OSV malware advisory MAL-2026-14023 blocks this version. The package auto-executes exfiltration code during npm install via preinstall and postinstall lifecycle scripts. preinstal...

OpenSSF/OSV malware advisory MAL-2026-14022 blocks this version. alelo-client@99.0.0 is a dependency-confusion / impersonation package targeting an internal 'Alelo' namespace (version 99....

OpenSSF/OSV malware advisory MAL-2026-14028 blocks this version. On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body...

OpenSSF/OSV malware advisory MAL-2026-14033 blocks this version. The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payl...