npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13443 blocks this version. diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket...

OpenSSF/OSV malware advisory MAL-2026-13443 blocks this version. diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket...

OpenSSF/OSV malware advisory MAL-2026-12472 blocks this version. The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan rout...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13515 blocks this version. eacq-dialog@35.8.1 contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js (loaded on...

OpenSSF/OSV malware advisory MAL-2026-13514 blocks this version. On require() of eacq-core, both _helpers.js and lib/telemetry.js download a platform-specific binary from Cloudflare Worke...

OpenSSF/OSV malware advisory MAL-2026-13513 blocks this version. Requiring the package executes _init.js, which selects a platform-specific payload path and fetches an executable over HTT...

OpenSSF/OSV malware advisory MAL-2026-13512 blocks this version. On require, index.js loads./_compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragmen...

OpenSSF/OSV malware advisory MAL-2026-13511 blocks this version. On require()/import, index.js loads _loader.js which fetches an opaque platform-specific binary from one of three obfuscat...

OpenSSF/OSV malware advisory MAL-2026-13510 blocks this version. The package's main entry unconditionally loads _ext.js, which on require/import downloads a platform-specific executable o...

OpenSSF/OSV malware advisory MAL-2026-13508 blocks this version. On require of the package, index.js loads lib/telemetry.js which, together with _bootstrap.js, fetches a platform-specific...

OpenSSF/OSV malware advisory MAL-2026-13505 blocks this version. On require() of the package's main entry, dolyame-ui-iconloaderhoc@35.8.1 executes two dropper paths that fetch platform-s...

OpenSSF/OSV malware advisory MAL-2026-13477 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced behaviors of conce...

OpenSSF/OSV malware advisory MAL-2026-13492 blocks this version. The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-ti...

OpenSSF/OSV malware advisory MAL-2026-13519 blocks this version. The package advertises itself as a streak/calendar math library, but its main entry `dist/index.mjs` contains a top-level...

OpenSSF/OSV malware advisory MAL-2026-12004 blocks this version. The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nod...

OpenSSF/OSV malware advisory MAL-2026-12004 blocks this version. The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nod...

OpenSSF/OSV malware advisory MAL-2026-13424 blocks this version. dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing eval(atob('<~32KB obfuscator.io payloa...

OpenSSF/OSV malware advisory MAL-2026-13424 blocks this version. dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing eval(atob('<~32KB obfuscator.io payloa...

OpenSSF/OSV malware advisory MAL-2026-13466 blocks this version. The package's bin entries (`wormgpt-cli`, `wormgpt`, `deepholegpt`, `wgpt`) map to `bin/victim.js`, which silently spawns...

OpenSSF/OSV malware advisory MAL-2026-13466 blocks this version. The package's bin entries (`wormgpt-cli`, `wormgpt`, `deepholegpt`, `wgpt`) map to `bin/victim.js`, which silently spawns...