npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12796 blocks this version. The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().usern...

OpenSSF/OSV malware advisory MAL-2026-12787 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, use...

OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...

OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...

OpenSSF/OSV malware advisory MAL-2026-11055 blocks this version. On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname(), os.platform(), and os.a...

OpenSSF/OSV malware advisory MAL-2026-12802 blocks this version. shift-v4-sdk@1.0.5 is a typosquat of the scoped package @shiftforex/shift-sdk-v4 (self-identified as such in a comment ins...

OpenSSF/OSV malware advisory MAL-2026-12803 blocks this version. The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, su...

OpenSSF/OSV malware advisory MAL-2026-11145 blocks this version. The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository f...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-11004 blocks this version. The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP s...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-12813 blocks this version. On npm install, the package's postinstall script executes index.js, which collects host identifiers (os.hostname(), os.use...

OpenSSF/OSV malware advisory MAL-2026-12793 blocks this version. The `helixbox-connect` bin opens a WebSocket to the hardcoded relay `wss://helixbox-relay.onrender.com` and dispatches mes...