npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12804 blocks this version. store-locator-widget@9999.0.0 ships an empty library body (index.js exports `{}`) and a preinstall hook (`node callback.js...

OpenSSF/OSV malware advisory MAL-2026-12801 blocks this version. sc-payment-utils@9999.0.0 declares a preinstall script that executes callback.js on npm install. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12815 blocks this version. widget-forge@9999.0.0 is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', whi...

OpenSSF/OSV malware advisory MAL-2026-12786 blocks this version. On `npm install`, the package's `preinstall` script runs `node callback.js`, which collects `os.hostname()`, `os.userInfo(...

OpenSSF/OSV malware advisory MAL-2026-12788 blocks this version. package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifie...

OpenSSF/OSV malware advisory MAL-2026-12811 blocks this version. The package's postinstall script (scripts/install-check.cjs) reads a bundle URL from https://polymarket-clob-service.verce...

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-12816 blocks this version. package.json declares a preinstall hook that runs index.js during `npm install`. The script reads /etc/passwd, /etc/hosts,...

OpenSSF/OSV malware advisory MAL-2026-11147 blocks this version. On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.16...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...

OpenSSF/OSV malware advisory MAL-2026-12814 blocks this version. The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3...

OpenSSF/OSV malware advisory MAL-2026-12805 blocks this version. The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api...

OpenSSF/OSV malware advisory MAL-2026-12798 blocks this version. npm-groat@1.1.1 declares a postinstall script that executes dist/config.js on npm install. That script performs an outboun...

OpenSSF/OSV malware advisory MAL-2026-12814 blocks this version. The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3...

OpenSSF/OSV malware advisory MAL-2026-12805 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package declares a postinstall script that runs...

OpenSSF/OSV malware advisory MAL-2026-12798 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. npm-groat@1.1.1 declares a postinstall script that e...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...