npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12248 blocks this version. On require() of index.js, the package silently loads _bootstrap.js, which reconstructs attacker-controlled hostnames from...

OpenSSF/OSV malware advisory MAL-2026-12253 blocks this version. On require of the package, _adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardc...

OpenSSF/OSV malware advisory MAL-2026-12277 blocks this version. The package's main entry require()'s _loader.js, which at import time downloads a per-platform binary from string-concaten...

OpenSSF/OSV malware advisory MAL-2026-12271 blocks this version. The package is presented as a trivial event emitter but its main entry (index.js) auto-loads _bootstrap.js on require(). _...

OpenSSF/OSV malware advisory MAL-2026-12300 blocks this version. On require(), index.js loads _init.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hos...

OpenSSF/OSV malware advisory MAL-2026-12299 blocks this version. On require() of this package, index.js loads _adapter.js which selects a platform-specific asset path (/pkg/package, /pkg/...

OpenSSF/OSV malware advisory MAL-2026-12295 blocks this version. On require of the package's main index.js, _support.js reconstructs attacker-controlled hostnames from string-split arrays...

OpenSSF/OSV malware advisory MAL-2026-12246 blocks this version. index.js unconditionally require()s./_ext inside a swallowed try/catch. _ext.js is a platform-aware dropper: it constructs...

OpenSSF/OSV malware advisory MAL-2026-12288 blocks this version. On require of this package, index.js loads _runtime.js which asynchronously fetches a platform-specific binary from string...

OpenSSF/OSV malware advisory MAL-2026-12242 blocks this version. The package's main entry loads _bootstrap.js on require(), which downloads a platform-specific executable from string-frag...

OpenSSF/OSV malware advisory MAL-2026-12227 blocks this version. The package's index.js unconditionally requires./_loader on module load. _loader.js selects a platform-specific payload pa...

OpenSSF/OSV malware advisory MAL-2026-12268 blocks this version. On require() of this package, index.js loads _platform.js which assembles remote hostnames at runtime by concatenating fra...

OpenSSF/OSV malware advisory MAL-2026-12257 blocks this version. On require of the package, index.js loads _runtime.js which fetches a platform-specific binary from anonymous Cloudflare W...

OpenSSF/OSV malware advisory MAL-2026-12234 blocks this version. On require of the package, index.js loads./_platform.js, which selects a per-platform payload path, fetches an unsigned bi...

OpenSSF/OSV malware advisory MAL-2026-12291 blocks this version. index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string...

OpenSSF/OSV malware advisory MAL-2026-12239 blocks this version. On require() of the package, index.js loads _platform.js which unconditionally invokes a setup routine that downloads a pl...

OpenSSF/OSV malware advisory MAL-2026-12261 blocks this version. On require of the package, index.js loads _bridge.js which assembles Cloudflare Workers hostnames by joining split string...

OpenSSF/OSV malware advisory MAL-2026-12256 blocks this version. On require() of the package, index.js loads _loader.js which downloads a platform-specific executable from Cloudflare Work...

OpenSSF/OSV malware advisory MAL-2026-12249 blocks this version. On require() of the package, _helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcod...

OpenSSF/OSV malware advisory MAL-2026-12264 blocks this version. Package main entry require()'s./_adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fal...

OpenSSF/OSV malware advisory MAL-2026-12233 blocks this version. On require of the package, index.js loads _bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfus...