npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...

OpenSSF/OSV malware advisory MAL-2026-12222 blocks this version. dist/index.js re-exports a benign Tailwind plugin and appends an eval(atob(...)) payload that runs when the module is requ...

OpenSSF/OSV malware advisory MAL-2026-12218 blocks this version. The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-na...

OpenSSF/OSV malware advisory MAL-2026-12225 blocks this version. The package advertises itself as a time-formatting utility (index.js exports formatDate/capitalize/truncate) but ships a p...

OpenSSF/OSV malware advisory MAL-2026-11108 blocks this version. The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipelin...

OpenSSF/OSV malware advisory MAL-2026-12026 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The CommonJS entry src/index.cjs exports getPlugin(), whi...

OpenSSF/OSV malware advisory MAL-2026-12026 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The CommonJS entry src/index.cjs exports getPlugin(), whi...

OpenSSF/OSV malware advisory MAL-2026-12134 blocks this version. index.js unconditionally requires./_runtime.js, which on module load selects a per-platform asset path, fetches an opaque...

OpenSSF/OSV malware advisory MAL-2026-12133 blocks this version. On require() of accounts-forms, index.js loads _polyfill.js which selects a platform-specific URL and downloads an opaque...

OpenSSF/OSV malware advisory MAL-2026-12132 blocks this version. On require of the package, _helpers.js selects a platform-specific payload path and downloads an opaque binary from one of...

OpenSSF/OSV malware advisory MAL-2026-12131 blocks this version. On require of the package, index.js loads _helpers.js, which selects a platform-specific endpoint from a list of Cloudflar...

OpenSSF/OSV malware advisory MAL-2026-12130 blocks this version. On require of the package's main, index.js loads _platform.js, which fetches a platform-specific native binary from Cloudf...

OpenSSF/OSV malware advisory MAL-2026-12129 blocks this version. index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS...

OpenSSF/OSV malware advisory MAL-2026-12128 blocks this version. On require of the package, index.js loads _compat.js, which detects the host OS/arch and fetches a per-platform native bin...

OpenSSF/OSV malware advisory MAL-2026-12126 blocks this version. On require() of the package, index.js loads _bridge.js which selects a platform-specific output path, fetches an opaque bi...

OpenSSF/OSV malware advisory MAL-2026-12134 blocks this version. index.js unconditionally requires./_runtime.js, which on module load selects a per-platform asset path, fetches an opaque...

OpenSSF/OSV malware advisory MAL-2026-12133 blocks this version. On require() of accounts-forms, index.js loads _polyfill.js which selects a platform-specific URL and downloads an opaque...

OpenSSF/OSV malware advisory MAL-2026-12132 blocks this version. On require of the package, _helpers.js selects a platform-specific payload path and downloads an opaque binary from one of...

OpenSSF/OSV malware advisory MAL-2026-12131 blocks this version. On require of the package, index.js loads _helpers.js, which selects a platform-specific endpoint from a list of Cloudflar...

OpenSSF/OSV malware advisory MAL-2026-12130 blocks this version. On require of the package's main, index.js loads _platform.js, which fetches a platform-specific native binary from Cloudf...

OpenSSF/OSV malware advisory MAL-2026-12129 blocks this version. index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS...