npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...

OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...

OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...

OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-12068 blocks this version. The npm package ledger-lib@1.0.0 presents itself as a Ledger hardware wallet library but ships no wallet functionality (in...

OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...

OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...

OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-12068 blocks this version. The npm package ledger-lib@1.0.0 presents itself as a Ledger hardware wallet library but ships no wallet functionality (in...

OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...

OpenSSF/OSV malware advisory MAL-2026-12067 blocks this version. hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads in...

OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...

OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...