npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11193 blocks this version. This npm package (a name resemblance to the WordPress LiteSpeed Cache plugin, which is not an npm module) ships a preinsta...

OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...

OpenSSF/OSV malware advisory MAL-2026-11056 blocks this version. On npm install, the package's preinstall script runs index.js which collects the installer's hostname, platform, architect...

OpenSSF/OSV malware advisory MAL-2026-11059 blocks this version. On `npm install`, the package's preinstall script in index.js collects host identifiers (os.hostname(), os.platform(), os....

OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...

OpenSSF/OSV malware advisory MAL-2026-11013 blocks this version. The package's main module core.js is heavily obfuscated (obfuscator.io-style string-array with self-defending anti-debug a...

OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...

OpenSSF/OSV malware advisory MAL-2026-11400 blocks this version. The package's main entry (index.js) re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply re...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-11018 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package veldora@1.0.1 was scanned across 6 files. No evid...

OpenSSF/OSV malware advisory MAL-2026-11016 blocks this version. The package vantora@1.0.0 (6 files) exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fe...

OpenSSF/OSV malware advisory MAL-2026-11016 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package vantora@1.0.0 (6 files) exhibits no observabl...

OpenSSF/OSV malware advisory MAL-2026-11019 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced code behavior indi...

OpenSSF/OSV malware advisory MAL-2026-10980 blocks this version. The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invok...

OpenSSF/OSV malware advisory MAL-2026-10984 blocks this version. veskra@1.0.0 contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetch...

OpenSSF/OSV malware advisory MAL-2026-10980 blocks this version. The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invok...

OpenSSF/OSV malware advisory MAL-2026-11053 blocks this version. package.json declares postinstall `node test.js` and `main: index.js`, but index.js is absent from the tarball. test.js ex...

OpenSSF/OSV malware advisory MAL-2026-10928 blocks this version. The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a...