npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12411 blocks this version. On require() of the package, index.js loads _loader.js which unconditionally executes init(). init() selects an OS-specifi...

OpenSSF/OSV malware advisory MAL-2026-12477 blocks this version. On `require('tcb-web-images')`, index.js loads _helpers.js which immediately runs a setup routine that selects an OS/arch-...

OpenSSF/OSV malware advisory MAL-2026-12456 blocks this version. index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, sel...

OpenSSF/OSV malware advisory MAL-2026-12440 blocks this version. index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to...

OpenSSF/OSV malware advisory MAL-2026-12453 blocks this version. On require() of the package, _support.js assembles remote hostnames from split-string array joins (e.g. ["oob-wo","rker.cf...

OpenSSF/OSV malware advisory MAL-2026-12419 blocks this version. The tarball contains only package.json and vishu.js; the declared main (index.js) is absent, so the package has no library...

OpenSSF/OSV malware advisory MAL-2026-12500 blocks this version. warp-drive-internal-tooling@99.9.9 declares a preinstall hook that runs index.js, which on Windows spawns a hidden-window...

OpenSSF/OSV malware advisory MAL-2026-12501 blocks this version. The package declares a preinstall script (node index.js) that, on Windows, spawns a hidden PowerShell window (-WindowStyle...

OpenSSF/OSV malware advisory MAL-2026-6406 blocks this version. Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveill...

OpenSSF/OSV malware advisory MAL-2026-12418 blocks this version. src/normalize-options.js is heavily obfuscated (RC4-decoded string array, hex-numeric literals, rotating string-array shuf...

OpenSSF/OSV malware advisory MAL-2026-12432 blocks this version. The package's postinstall script (src/test.js) issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate v...

OpenSSF/OSV malware advisory MAL-2026-12429 blocks this version. The npm package rollup-plugins-check@0.0.2 declares a postinstall script (`node dist/module.js`) that, on `npm install`, p...

OpenSSF/OSV malware advisory MAL-2026-12429 blocks this version. The npm package rollup-plugins-check@0.0.2 declares a postinstall script (`node dist/module.js`) that, on `npm install`, p...

OpenSSF/OSV malware advisory MAL-2026-12430 blocks this version. rollup-plugins-polyfills-rode@0.13.1 is a typosquat of rollup-plugin-polyfill-node (whose repository URL it copies verbati...

OpenSSF/OSV malware advisory MAL-2026-12430 blocks this version. rollup-plugins-polyfills-rode@0.13.1 is a typosquat of rollup-plugin-polyfill-node (whose repository URL it copies verbati...

OpenSSF/OSV malware advisory MAL-2026-12470 blocks this version. streak-metricsa@1.0.0 presents itself as a calendar-day math helper but its main entry (dist/index.mjs, the default `expor...

OpenSSF/OSV malware advisory MAL-2026-12478 blocks this version. package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded ba...

OpenSSF/OSV malware advisory MAL-2026-12478 blocks this version. package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded ba...

OpenSSF/OSV malware advisory MAL-2026-12478 blocks this version. package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded ba...

OpenSSF/OSV malware advisory MAL-2026-12494 blocks this version. ventrix-kit@1.5.2 ships a loader that, when the package's default `getPlugin` export is invoked, performs an HTTP request...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...