npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-10891 blocks this version. No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity,...

OpenSSF/OSV malware advisory MAL-2026-6067 blocks this version. The CLI binary at bin/scan-only.js, when invoked (e.g., via `npx scan-only --diagnose`), harvests installer-side secrets an...

OpenSSF/OSV malware advisory MAL-2026-10891 blocks this version. No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity,...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10897 blocks this version. Package self-identifies as a security research test ('Security research test - do not install'). The package.json `homepag...

OpenSSF/OSV malware advisory MAL-2026-11014 blocks this version. The package advertises itself as a high-throughput bulk-mail tool and ships every one of its ~50 JS files (cli.js, denv.js...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...