npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10723 blocks this version. The package installs itself as a user-level service (systemd on Linux via service/linux.js, with launchd/PM2 siblings) and...

OpenSSF/OSV malware advisory MAL-2026-10717 blocks this version. The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https:/...

OpenSSF/OSV malware advisory MAL-2026-10705 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's runtime connects to a hardcoded WebSoc...

OpenSSF/OSV malware advisory MAL-2026-10707 blocks this version. The `@ai-support-agent/cli` package installs a long-running daemon (`ai-support-agent start`) that connects to a vendor AP...

OpenSSF/OSV malware advisory MAL-2026-10706 blocks this version. The host daemon opens an outbound WebSocket connection to a hardcoded default proxy (https://proxy.agentvox.bot) and, on r...

OpenSSF/OSV malware advisory MAL-2026-10719 blocks this version. The CommonJS bundle loaded by `require('@thepayulink/server')` (dist/payulink-server.cjs) hardcodes `apiBase` to `https://...

OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10710 blocks this version. This package typosquats @openai/codex under an unofficial scope and ships a postinstall hook (package.json line 6: "postin...

OpenSSF/OSV malware advisory MAL-2026-10716 blocks this version. The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.j...

OpenSSF/OSV malware advisory MAL-2026-10715 blocks this version. The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an em...

OpenSSF/OSV malware advisory MAL-2026-10714 blocks this version. index.js (the package main) executes at require-time and performs credential and host exfiltration. It iterates process.en...

OpenSSF/OSV malware advisory MAL-2026-10704 blocks this version. The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of A...

OpenSSF/OSV malware advisory MAL-2026-10703 blocks this version. @across-toolkit/eslint-config@99.0.1 runs a postinstall.js script on npm install that harvests installer-side secrets and...

OpenSSF/OSV malware advisory MAL-2026-10700 blocks this version. On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated...

OpenSSF/OSV malware advisory MAL-2026-10704 blocks this version. The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of A...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. The package ships heavily obfuscated runtime files (dist/index.js, dist/launcher.js) built with javascript-obfuscator. The...

OpenSSF/OSV malware advisory MAL-2026-10735 blocks this version. On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.c...

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.