npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12210 blocks this version. index.js unconditionally requires./_bridge on load. _bridge.js selects a per-OS binary URL from a list of string-split-con...

OpenSSF/OSV malware advisory MAL-2026-12374 blocks this version. index.js unconditionally requires _vendor.js on load. _vendor.js selects a platform-specific payload path, downloads an op...

OpenSSF/OSV malware advisory MAL-2026-12181 blocks this version. The package's main entry (index.js) unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers...

OpenSSF/OSV malware advisory MAL-2026-12185 blocks this version. On require, pfa-autotests-reporter loads _adapter.js which selects a platform-specific path, fetches a binary over HTTPS f...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package installs a `whalent` CLI daemon that ope...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-13379 blocks this version. On require() of this package, index.js loads _compat.js which selects a platform-specific payload path, fetches an opaque...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...