npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-12816 blocks this version. package.json declares a preinstall hook that runs index.js during `npm install`. The script reads /etc/passwd, /etc/hosts,...

OpenSSF/OSV malware advisory MAL-2026-11147 blocks this version. On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.16...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...

OpenSSF/OSV malware advisory MAL-2026-12814 blocks this version. The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3...

OpenSSF/OSV malware advisory MAL-2026-12805 blocks this version. The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api...

OpenSSF/OSV malware advisory MAL-2026-12798 blocks this version. npm-groat@1.1.1 declares a postinstall script that executes dist/config.js on npm install. That script performs an outboun...

OpenSSF/OSV malware advisory MAL-2026-12814 blocks this version. The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3...

OpenSSF/OSV malware advisory MAL-2026-12805 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package declares a postinstall script that runs...

OpenSSF/OSV malware advisory MAL-2026-12798 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. npm-groat@1.1.1 declares a postinstall script that e...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-12809 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-12790 blocks this version. package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current...

OpenSSF/OSV malware advisory MAL-2026-12796 blocks this version. The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().usern...

OpenSSF/OSV malware advisory MAL-2026-12787 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, use...

OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...