npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...

OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

OpenSSF/OSV malware advisory MAL-2026-11041 blocks this version. The package declares a postinstall script (postinstall.js) that runs automatically on npm/pnpm install and POSTs host iden...

OpenSSF/OSV malware advisory MAL-2026-11124 blocks this version. On `npm install`, the package's postinstall hook (`node test.js`) executes an attacker-controlled workflow against the ins...

OpenSSF/OSV malware advisory MAL-2026-11125 blocks this version. On npm install, the package's postinstall hook (`node test.js`) executes two payloads against the installer host. First, i...

OpenSSF/OSV malware advisory MAL-2026-11129 blocks this version. package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, te...

OpenSSF/OSV malware advisory MAL-2026-11128 blocks this version. app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on `npm install` through a `pos...

OpenSSF/OSV malware advisory MAL-2026-11130 blocks this version. The package's main file index.js is a heavily obfuscated (obfuscator.io RC4+base64 string-array) module whose top-level II...

OpenSSF/OSV malware advisory MAL-2026-11131 blocks this version. package.json declares `preinstall: node index.js`, so `npm install basic-vite` auto-executes index.js. The script collects...

OpenSSF/OSV malware advisory MAL-2026-11126 blocks this version. package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes from_str_2() and from_str_...

OpenSSF/OSV malware advisory MAL-2026-11123 blocks this version. The npm package `@yancyyu/agentcli` ships a Feishu/Lark credential stealer. An auto-started telemetry worker (`src/main/te...

OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...

OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...

OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...

OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...

OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...

OpenSSF/OSV malware advisory MAL-2026-11122 blocks this version. dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXA...

OpenSSF/OSV malware advisory MAL-2026-11121 blocks this version. The npm package @apexfnd/apex ships a postinstall script (install.cjs) that performs two install-time remote-code-executio...

OpenSSF/OSV malware advisory MAL-2026-11121 blocks this version. The npm package @apexfnd/apex ships a postinstall script (install.cjs) that performs two install-time remote-code-executio...

OpenSSF/OSV malware advisory MAL-2026-11118 blocks this version. The npm postinstall script in array-sort-helper@1.0.0 automatically runs on `npm install` and executes a shell reconnaissa...