npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...

OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...

OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...

OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...

OpenSSF/OSV malware advisory MAL-2026-11081 blocks this version. Package name `amanexzyra-baileys` resembles the popular WhatsApp Web API library `@whiskeysockets/baileys` family, which h...