npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5548 blocks this version. On require('@403name/ether-js'), index.js runs an IIFE that targets macOS only (returns early on non-darwin and when CI/GIT...

OpenSSF/OSV malware advisory MAL-2026-5554 blocks this version. On install, the package's postinstall hook (scripts/inject.js) locates the installer's project root and main entry (from pa...

OpenSSF/OSV malware advisory MAL-2026-5553 blocks this version. On `npm install`, the package's `postinstall` hook (`node scripts/inject.js`) walks up from the install directory to locate...

OpenSSF/OSV malware advisory MAL-2026-5552 blocks this version. On `npm install`, the package's `postinstall` runs `scripts/inject.js`, which walks up from the current working directory t...

OpenSSF/OSV malware advisory MAL-2026-5551 blocks this version. On `npm install`, the package's postinstall script (scripts/inject.js) locates the consumer project's main Express entry fi...

OpenSSF/OSV malware advisory MAL-2026-5550 blocks this version. On `npm install`, the package's postinstall hook (`scripts/inject.js`) locates the installer's host project root, identifie...

OpenSSF/OSV malware advisory MAL-2026-11072 blocks this version. The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path (via __filename with se...

OpenSSF/OSV malware advisory MAL-2026-11071 blocks this version. whs4_eud@1.0.1 declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On e...

OpenSSF/OSV malware advisory MAL-2026-11070 blocks this version. package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's a...

OpenSSF/OSV malware advisory MAL-2026-11069 blocks this version. The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-11069 blocks this version. The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-11066 blocks this version. On npm install, the package's preinstall lifecycle script (preinstall.js) reads a hex-encoded command string from preinsta...

OpenSSF/OSV malware advisory MAL-2026-11065 blocks this version. Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install ti...

OpenSSF/OSV malware advisory MAL-2026-11064 blocks this version. On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home di...

OpenSSF/OSV malware advisory MAL-2023-8293 blocks this version. index.js runs automatically via a preinstall lifecycle hook on `npm install` and collects host identifiers from the install...

OpenSSF/OSV malware advisory MAL-2023-1491 blocks this version. The package's preinstall hook auto-executes index.js on `npm install`. The script imports `https` and `os`, collects `os.ho...

OpenSSF/OSV malware advisory MAL-2026-11055 blocks this version. On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname(), os.platform(), and os.a...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...

OpenSSF/OSV malware advisory MAL-2026-11001 blocks this version. The npm package `date-format-utils-xz` masquerades as a date-formatting utility but is malicious. Its own decoy `index.js`...