npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10717 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The npm postinstall hook runs ensurePlatformBinary()...

OpenSSF/OSV malware advisory MAL-2026-12402 blocks this version. The package ships a single ~10 MB Rust-compiled Linux x86_64 N-API native module (tools.linux-x64-gnu.node) referenced by...

OpenSSF/OSV malware advisory MAL-2026-10717 blocks this version. The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https:/...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13389 blocks this version. No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing re...

OpenSSF/OSV malware advisory MAL-2026-13395 blocks this version. src/index.js imports child_process and issues POST requests alongside a ping command invocation (lines 25, 38, 49). The co...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-13397 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package implements a daemon that pairs with a re...

OpenSSF/OSV malware advisory MAL-2026-13397 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package implements a daemon that pairs with a re...

OpenSSF/OSV malware advisory MAL-2026-13397 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package implements a daemon that pairs with a re...

OpenSSF/OSV malware advisory MAL-2026-13398 blocks this version. On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/ag...

OpenSSF/OSV malware advisory MAL-2026-13392 blocks this version. The package's main module (cdp_inject.js) runs on require. It disables TLS certificate verification process-wide (process....

OpenSSF/OSV malware advisory MAL-2026-13393 blocks this version. wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a sna...