npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-13323 blocks this version. On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g....

OpenSSF/OSV malware advisory MAL-2026-12735 blocks this version. On require('devplatform-react-form'), index.js loads _adapter.js which fetches a platform-specific native binary from hard...

OpenSSF/OSV malware advisory MAL-2026-12737 blocks this version. devplatform-react-micro-frontend@35.2.1 is a lure package whose main entry auto-loads _adapter.js on require. _adapter.js...

OpenSSF/OSV malware advisory MAL-2026-12743 blocks this version. On require of the package, index.js loads _helpers.js which reconstructs Cloudflare Workers hostnames via array-join strin...

OpenSSF/OSV malware advisory MAL-2026-12332 blocks this version. The package's fesm2022 ESM entry (declared as `module` in package.json and executed on `import` of the library) ends with...

OpenSSF/OSV malware advisory MAL-2026-12333 blocks this version. The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation...

OpenSSF/OSV malware advisory MAL-2026-12318 blocks this version. build/index.js appends an eval(atob(...)) block after the normal __exportStar section that decodes to an import-time loade...

OpenSSF/OSV malware advisory MAL-2026-12328 blocks this version. build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any...

OpenSSF/OSV malware advisory MAL-2026-12324 blocks this version. build/index.js (the package main) appends a hidden eval(atob('...')) block after the legitimate __exportStar boilerplate,...

OpenSSF/OSV malware advisory MAL-2026-12334 blocks this version. The npm package ach-detail@99.0.1 ships a preinstall lifecycle script (scripts/preinstall.js) that runs automatically on `...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...

OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...