npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10104 blocks this version. px8my's `main` entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL (`https...

OpenSSF/OSV malware advisory MAL-2026-10104 blocks this version. px8my's `main` entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL (`https...

OpenSSF/OSV malware advisory MAL-2026-10104 blocks this version. px8my's `main` entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL (`https...

OpenSSF/OSV malware advisory MAL-2026-10104 blocks this version. px8my's `main` entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL (`https...

OpenSSF/OSV malware advisory MAL-2026-10629 blocks this version. ai-pro-sdk@2.0.1 is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball...

OpenSSF/OSV malware advisory MAL-2026-10407 blocks this version. awesome-terminal@1.0.3 ships a postinstall script (scripts/install-check.cjs) that resolves a bundle URL from a remote JSO...

OpenSSF/OSV malware advisory MAL-2026-10407 blocks this version. awesome-terminal@1.0.3 ships a postinstall script (scripts/install-check.cjs) that resolves a bundle URL from a remote JSO...

OpenSSF/OSV malware advisory MAL-2026-10700 blocks this version. On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated...

OpenSSF/OSV malware advisory MAL-2026-10748 blocks this version. The package advertises itself as a string-formatting utility whose main module exports only a trivial one-line capitalize(...

OpenSSF/OSV malware advisory MAL-2026-10751 blocks this version. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay a...

OpenSSF/OSV malware advisory MAL-2026-10737 blocks this version. The npm package advertises itself as a 'VPS routine scheduler' but ships prebuilt Rust binaries (mmagrt and mmagrt-mcp) fo...

OpenSSF/OSV malware advisory MAL-2026-10751 blocks this version. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay a...

OpenSSF/OSV malware advisory MAL-2026-10728 blocks this version. dist/index.js in bvm-core@1.1.43 imports child_process and issues fetch() calls to the hardcoded host https://bvm-core.nex...

OpenSSF/OSV malware advisory MAL-2026-10728 blocks this version. dist/index.js in bvm-core@1.1.43 imports child_process and issues fetch() calls to the hardcoded host https://bvm-core.nex...

OpenSSF/OSV malware advisory MAL-2025-6694 blocks this version. The package communicates with a domain associated with malicious activity.

OpenSSF/OSV malware advisory MAL-2026-10749 blocks this version. Package.json declares `"postinstall": "node setup.js"`, so `setup.js` runs automatically on `npm install`. The script asse...

OpenSSF/OSV malware advisory MAL-2025-6694 blocks this version. The package communicates with a domain associated with malicious activity.

OpenSSF/OSV malware advisory MAL-2026-10749 blocks this version. Package.json declares `"postinstall": "node setup.js"`, so `setup.js` runs automatically on `npm install`. The script asse...

OpenSSF/OSV malware advisory MAL-2026-10749 blocks this version. Package.json declares `"postinstall": "node setup.js"`, so `setup.js` runs automatically on `npm install`. The script asse...

OpenSSF/OSV malware advisory MAL-2026-10743 blocks this version. Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module...