npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12091 blocks this version. On require(), index.js reads the full process.env map along with hostname, username, homedir, platform, and cwd, JSON-stri...

OpenSSF/OSV malware advisory MAL-2026-12089 blocks this version. On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and PO...

OpenSSF/OSV malware advisory MAL-2026-12087 blocks this version. On require(), index.js reads the entire process.env plus host identifiers (hostname, username, homedir, platform, cwd, tim...

OpenSSF/OSV malware advisory MAL-2026-12088 blocks this version. On require(), index.js collects the full process.env object together with hostname, username, home directory, platform, cu...

OpenSSF/OSV malware advisory MAL-2026-12086 blocks this version. On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and th...

OpenSSF/OSV malware advisory MAL-2026-12085 blocks this version. Package presents itself as a drop-in replacement for the popular `bip39` library but ships a credential stealer in its mai...

OpenSSF/OSV malware advisory MAL-2026-12107 blocks this version. On module load, index.js collects the host identifiers (os.hostname(), os.userInfo().username, home directory, platform, c...

OpenSSF/OSV malware advisory MAL-2026-12106 blocks this version. Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the expo...

OpenSSF/OSV malware advisory MAL-2026-12104 blocks this version. On require() of the package, index.js collects the machine hostname, OS username, package name, and a timestamp and sends...

OpenSSF/OSV malware advisory MAL-2026-12105 blocks this version. The package presents itself as a drop-in replacement for the legitimate tronweb SDK (author field 'tronprotocol', README a...

OpenSSF/OSV malware advisory MAL-2026-11181 blocks this version. The package is advertised as a docs/landing site for 'Theta Data API', but its main entry (index.js) re-exports a single v...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-11105 blocks this version. package.json declares a `preinstall` script that runs `node index.js` on `npm install`. index.js collects host identifiers...

OpenSSF/OSV malware advisory MAL-2026-11090 blocks this version. Package txs-random-lib@1.0.1 was inspected but no concrete a static rule matches or traced-code findings are available for...