npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12435 blocks this version. sc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The s...

OpenSSF/OSV malware advisory MAL-2026-12427 blocks this version. Package version 9999.0.0 is published with placeholder metadata ("Shared utility helpers.", no author) — the canonical sha...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12433 blocks this version. saas-f-lego-landings@20.7.5 executes a native binary dropper as a side effect of loading the package. index.js uncondition...

OpenSSF/OSV malware advisory MAL-2026-12410 blocks this version. On require of the package, index.js unconditionally loads _shim.js, which selects a payload path based on process.platform...

OpenSSF/OSV malware advisory MAL-2026-12445 blocks this version. index.js unconditionally require()s _bridge.js, which on load detects OS and architecture, assembles destination hostnames...

OpenSSF/OSV malware advisory MAL-2026-12451 blocks this version. The package presents itself as a Keycloak typed client but on require() executes a binary dropper. index.js loads _adapter...

OpenSSF/OSV malware advisory MAL-2026-12439 blocks this version. On require/import of the package, index.js unconditionally loads _runtime.js, which downloads a platform-specific binary f...

OpenSSF/OSV malware advisory MAL-2026-12413 blocks this version. On require(), _polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several *.w...

OpenSSF/OSV malware advisory MAL-2026-12415 blocks this version. index.js unconditionally requires./_support on module load. _support.js reconstructs attacker-controlled hostnames by arra...

OpenSSF/OSV malware advisory MAL-2026-12454 blocks this version. On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary fr...

OpenSSF/OSV malware advisory MAL-2026-12486 blocks this version. On require() of the package, index.js loads _ext.js which downloads a platform-specific binary from runtime-assembled Clou...

OpenSSF/OSV malware advisory MAL-2026-12409 blocks this version. On require() of pfp-block-mobile-past-meetup-list, index.js loads _ext.js which runs a bootstrap routine. It fetches a pla...

OpenSSF/OSV malware advisory MAL-2026-12443 blocks this version. On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames...

OpenSSF/OSV malware advisory MAL-2026-12408 blocks this version. On require of the package, index.js loads _bootstrap.js, which selects a platform-specific payload path, fetches bytes fro...

OpenSSF/OSV malware advisory MAL-2026-12489 blocks this version. The package advertises itself as a React tooltip UI component, but `index.js` (declared `main`) unconditionally requires `...