npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13734 blocks this version. @aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate func...

OpenSSF/OSV malware advisory MAL-2026-13734 blocks this version. @aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate func...

OpenSSF/OSV malware advisory MAL-2026-13738 blocks this version. @openzeppelin-5/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13738 blocks this version. @openzeppelin-5/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13737 blocks this version. @openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13737 blocks this version. @openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13736 blocks this version. The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-<platform>-<ar...

This package performs unconsented install-time staging of unverified remote executables and establishes a later execution/update chain. That is a concrete remote-payload execution risk, n...

OpenSSF/OSV malware advisory MAL-2026-13721 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced code findings were...

OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...

OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...

OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...

OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...

OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...

OpenSSF/OSV malware advisory MAL-2026-13713 blocks this version. The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmka...

OpenSSF/OSV malware advisory MAL-2026-13720 blocks this version. eth-library-toolkit@2.1.3 presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethere...

OpenSSF/OSV malware advisory MAL-2026-10676 blocks this version. The package name resembles Node.js's built-in `assert` module. On require(), `index.js` spawns a detached `node` child pro...

OpenSSF/OSV malware advisory MAL-2026-13716 blocks this version. @sqlite-prime/nodesql@1.0.6 ships a verbatim copy of the well-known `buffer` library as its main entry (`index.js`) with a...

OpenSSF/OSV malware advisory MAL-2026-13716 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. @sqlite-prime/nodesql@1.0.6 ships a verbatim copy of...

OpenSSF/OSV malware advisory MAL-2026-13716 blocks this version. LPM AI assessed this version as clean; the assessments disagree. @sqlite-prime/nodesql@1.0.6 ships a verbatim copy of the...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...