npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5559 blocks this version. On `npm install`, the package's postinstall hook (`node install.js`) executes a multi-stage attack against the installer's...

OpenSSF/OSV malware advisory MAL-2026-5573 blocks this version. On `npm install`, the package's postinstall hook runs install.js which performs four independent attacker-benefit actions....

OpenSSF/OSV malware advisory MAL-2026-5988 blocks this version. The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate...

OpenSSF/OSV malware advisory MAL-2026-6135 blocks this version. Package is not a library. `main` points at `sw.js`, a browser Service Worker that uses `importScripts`, `self.addEventListe...

OpenSSF/OSV malware advisory MAL-2026-10387 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10396 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10906 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-10113 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10112 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...

OpenSSF/OSV malware advisory MAL-2026-5670 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-3311 blocks this version. path-addon impersonates the Node.js core `path` module (package name `path-addon`, README claims to be 'an exact copy of th...

OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...

OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-5850 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...