npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12312 blocks this version. Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches...

OpenSSF/OSV malware advisory MAL-2026-13390 blocks this version. Package is a fork of the Baileys WhatsApp Web library. Static keyword co-occurrence patterns matched on lib/Utils/generics...

OpenSSF/OSV malware advisory MAL-2026-12373 blocks this version. On require of the package, index.js loads _shim.js which downloads a platform-specific binary from hardcoded Cloudflare Wo...

OpenSSF/OSV malware advisory MAL-2026-12385 blocks this version. On require() of the package, index.js loads _bootstrap.js, which selects a platform-specific payload (linux_x64, linux_arm...

OpenSSF/OSV malware advisory MAL-2026-12210 blocks this version. index.js unconditionally requires./_bridge on load. _bridge.js selects a per-OS binary URL from a list of string-split-con...

OpenSSF/OSV malware advisory MAL-2026-12374 blocks this version. index.js unconditionally requires _vendor.js on load. _vendor.js selects a platform-specific payload path, downloads an op...

OpenSSF/OSV malware advisory MAL-2026-12181 blocks this version. The package's main entry (index.js) unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers...

OpenSSF/OSV malware advisory MAL-2026-12185 blocks this version. On require, pfa-autotests-reporter loads _adapter.js which selects a platform-specific path, fetches a binary over HTTPS f...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...