npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...

OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...

OpenSSF/OSV malware advisory MAL-2026-12319 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall...

OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...

OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...

OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...

OpenSSF/OSV malware advisory MAL-2026-12317 blocks this version. package.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon...

OpenSSF/OSV malware advisory MAL-2026-12315 blocks this version. On npm install, the package's postinstall script (dist/recon.js) collects installer-side host reconnaissance — hostname, u...

OpenSSF/OSV malware advisory MAL-2026-12327 blocks this version. On `npm install`, the package's postinstall script (`node index.js`) collects host identifiers (`os.hostname()`, `os.userI...

OpenSSF/OSV malware advisory MAL-2026-12325 blocks this version. On require(), index.js unconditionally calls a telemetry() function at module top level that collects host reconnaissance...

OpenSSF/OSV malware advisory MAL-2026-12310 blocks this version. The package's declared main (index.js) unconditionally requires./_init on load. _init.js selects a platform-specific asset...

OpenSSF/OSV malware advisory MAL-2026-12309 blocks this version. On require of the package (index.js loads./_vendor at import), _vendor.js selects a platform-specific staging path, downlo...

OpenSSF/OSV malware advisory MAL-2026-12224 blocks this version. dist/index.js appends `eval(atob('...'))` after the legitimate CSS-plugin export, so simply importing or requiring the pac...

OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...

OpenSSF/OSV malware advisory MAL-2026-12217 blocks this version. index.js appends a large base64-encoded, unicode-escaped payload after ~11 KB of whitespace padding, executed via eval(ato...

OpenSSF/OSV malware advisory MAL-2026-12216 blocks this version. stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and uncondit...

OpenSSF/OSV malware advisory MAL-2026-12267 blocks this version. On require() of the package's main index.js, _loader.js selects a platform-specific endpoint and fetches an opaque native...

OpenSSF/OSV malware advisory MAL-2026-12286 blocks this version. On require of the package, index.js loads _bridge.js which selects a platform-specific payload path, fetches bytes over HT...

OpenSSF/OSV malware advisory MAL-2026-12254 blocks this version. Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./_init on load...

OpenSSF/OSV malware advisory MAL-2026-12238 blocks this version. The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require(), index.js loads _shim.js,...