npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12115 blocks this version. The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spaw...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...

OpenSSF/OSV malware advisory MAL-2026-11483 blocks this version. The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network ac...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11490 blocks this version. The package contains three files and produced no a static rule matches and no traced code behaviors of concern. The name a...

OpenSSF/OSV malware advisory MAL-2026-11492 blocks this version. No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of insta...

OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...

OpenSSF/OSV malware advisory MAL-2026-11390 blocks this version. No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code,...