npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-10891 blocks this version. No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity,...

OpenSSF/OSV malware advisory MAL-2026-6067 blocks this version. The CLI binary at bin/scan-only.js, when invoked (e.g., via `npx scan-only --diagnose`), harvests installer-side secrets an...

OpenSSF/OSV malware advisory MAL-2026-10891 blocks this version. No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity,...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10897 blocks this version. Package self-identifies as a security research test ('Security research test - do not install'). The package.json `homepag...

OpenSSF/OSV malware advisory MAL-2026-11014 blocks this version. The package advertises itself as a high-throughput bulk-mail tool and ships every one of its ~50 JS files (cli.js, denv.js...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-5624 blocks this version. On `npm install`, postinstall.js reads the installer's `.env` file from INIT_CWD, harvests environment variable values (DEM...

OpenSSF/OSV malware advisory MAL-2026-11083 blocks this version. No suspicious behaviors were identified in this package version. There is no evidence of install-time network activity, li...

OpenSSF/OSV malware advisory MAL-2026-11082 blocks this version. No suspicious code patterns, lifecycle hooks, network destinations, or credential-access behaviors were identified in this...

OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...