npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...

OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...

OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...

OpenSSF/OSV malware advisory MAL-2026-11822 blocks this version. npm/@servicetitan/anvil2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...

OpenSSF/OSV malware advisory MAL-2026-12038 blocks this version. The package's main entry requires `./_ext`, which on load downloads a platform-specific binary from hardcoded Cloudflare W...

OpenSSF/OSV malware advisory MAL-2026-12037 blocks this version. On require, index.js loads _polyfill.js which selects a platform-specific endpoint, downloads an opaque native binary over...

OpenSSF/OSV malware advisory MAL-2026-12036 blocks this version. On require() of bigops-chat-tmsg, index.js silently loads _runtime.js (via a swallowed try/require appended after an empty...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12035 blocks this version. bigops-auth-utils@35.4.5 executes an install-time binary dropper on any require/import of the package. index.js top-level...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12051 blocks this version. On require of the package's main entry, _compat.js downloads a platform-specific binary from Cloudflare Workers subdomains...

OpenSSF/OSV malware advisory MAL-2026-12042 blocks this version. The package's index.js unconditionally loads _bridge.js on require. _bridge.js downloads a platform-specific native binary...

OpenSSF/OSV malware advisory MAL-2026-12049 blocks this version. On require of the package, _platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers host...

OpenSSF/OSV malware advisory MAL-2026-12050 blocks this version. The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload...

OpenSSF/OSV malware advisory MAL-2026-12041 blocks this version. On require() of the package, index.js loads./_compat.js whose top-level init() downloads a platform-specific binary from a...

OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...

OpenSSF/OSV malware advisory MAL-2026-12039 blocks this version. The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install an...

OpenSSF/OSV malware advisory MAL-2026-12039 blocks this version. The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install an...