npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12216 blocks this version. stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and uncondit...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12216 blocks this version. stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and uncondit...

OpenSSF/OSV malware advisory MAL-2026-13344 blocks this version. On Windows, `npm install ezfnfix` automatically executes a bundled Windows PE binary via a postinstall hook. package.json...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-13350 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The shipped Windows-x64 prebuilt `hello.node` embeds...

OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...

OpenSSF/OSV malware advisory MAL-2026-13342 blocks this version. index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (load...

OpenSSF/OSV malware advisory MAL-2026-12386 blocks this version. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12386 blocks this version. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host...