npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-13727 blocks this version. No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libra...

This package disguises a backdoor ELF as a native calendar-math accelerator and executes it at import time. No lifecycle hook is needed for the concrete malicious runtime chain.

The shipped API does not need this installer, while its postinstall executes a remotely controlled dependency payload. This is concrete install-time remote code execution.

Source inspection confirms a concrete privileged remote-access persistence chain activated by postinstall, not merely a risky utility. Documentation does not make automatic hidden-account...

The package has a concrete, concealed install-time data-exfiltration path. The Sentry dynamic require is package-aligned and does not mitigate the lifecycle-hook behavior.

OpenSSF/OSV malware advisory MAL-2026-13725 blocks this version. Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator...

OpenSSF/OSV malware advisory MAL-2026-13725 blocks this version. Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator...

OpenSSF/OSV malware advisory MAL-2026-13725 blocks this version. Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator...

OpenSSF/OSV malware advisory MAL-2026-13725 blocks this version. Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator...

OpenSSF/OSV malware advisory MAL-2026-13723 blocks this version. lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require()'d (reachable via lang/...

OpenSSF/OSV malware advisory MAL-2026-13722 blocks this version. The package's main entry file (index.js) contains a legitimate Express file-server module followed by a unicode-escape-obf...

Source inspection confirms a concealed, automatic browser-redirection chain behind a security-verification lure. Absence of install hooks does not mitigate the delivered malicious runtime...

Direct source inspection confirms unconsented install-time remote beaconing and shell execution. The claimed PoC purpose does not remove the concrete behavior affecting every installer.

Direct source inspection confirms unconsented install-time network activity, not merely a static hint. No broader payload behavior was found, but the concrete lifecycle beacon warrants bl...

The runtime backdoor performs unconsented, remotely controlled mutations of the user's authenticated WhatsApp account. Lifecycle hooks are benign, but do not mitigate this concrete behavior.

OpenSSF/OSV malware advisory MAL-2026-13706 blocks this version. Package neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./...

OpenSSF/OSV malware advisory MAL-2026-13691 blocks this version. @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names ('fs','...