npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10513 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10468 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10335 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-10298 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10687 blocks this version. selparsecss-selector@2.1.0 is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid'...

OpenSSF/OSV malware advisory MAL-2026-10687 blocks this version. selparsecss-selector@2.1.0 is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid'...

OpenSSF/OSV malware advisory MAL-2026-10687 blocks this version. selparsecss-selector@2.1.0 is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid'...

OpenSSF/OSV malware advisory MAL-2026-10687 blocks this version. selparsecss-selector@2.1.0 is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid'...

OpenSSF/OSV malware advisory MAL-2026-10683 blocks this version. The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissan...

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

OpenSSF/OSV malware advisory MAL-2026-10752 blocks this version. The package's sole file i.js (declared as main) is a heavily obfuscated IIFE whose top-level exploit() runs unconditionall...

OpenSSF/OSV malware advisory MAL-2026-10752 blocks this version. The package's sole file i.js (declared as main) is a heavily obfuscated IIFE whose top-level exploit() runs unconditionall...

OpenSSF/OSV malware advisory MAL-2026-10680 blocks this version. The package's postinstall lifecycle script contacts a hardcoded plain-HTTP endpoint at http://player.sweeprovider.org, ret...

OpenSSF/OSV malware advisory MAL-2026-10678 blocks this version. Package declares a `preinstall` script (`node./index.js`) that fires automatically on `npm install`. The executed `index.j...

OpenSSF/OSV malware advisory MAL-2026-10679 blocks this version. Package is advertised as 'A minimalist Git wrapper tool'. When the user runs the documented `rakibox push` command, the CL...

OpenSSF/OSV malware advisory MAL-2026-10677 blocks this version. The SDK's captureSnapshot() iterates Object.entries(process.env) and attaches every environment variable to every captured...

OpenSSF/OSV malware advisory MAL-2026-10673 blocks this version. gulp-jscrambler is a Gulp plugin wrapping the Jscrambler code-protection API. No install-time lifecycle scripts, credentia...

OpenSSF/OSV malware advisory MAL-2026-10674 blocks this version. jscrambler-metro-plugin@9.0.2 is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule...

OpenSSF/OSV malware advisory MAL-2026-10665 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10665 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...