npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10640 blocks this version. The package exposes `validate(t)` and `randomBytes(t,e)` which route their arguments through an internal `check_validator`...

OpenSSF/OSV malware advisory MAL-2026-10640 blocks this version. The package exposes `validate(t)` and `randomBytes(t,e)` which route their arguments through an internal `check_validator`...

OpenSSF/OSV malware advisory MAL-2026-10633 blocks this version. The package has no functional library code: package.json declares main=index.js but no index.js is shipped; the tarball co...

OpenSSF/OSV malware advisory MAL-2026-10595 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10639 blocks this version. The package ships an Express middleware that, on each incoming request, POSTs {appId, endpoint} to a configured `${baseUrl...

OpenSSF/OSV malware advisory MAL-2026-10639 blocks this version. The package ships an Express middleware that, on each incoming request, POSTs {appId, endpoint} to a configured `${baseUrl...

OpenSSF/OSV malware advisory MAL-2026-10554 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...

OpenSSF/OSV malware advisory MAL-2026-10635 blocks this version. Package exports a complete Gmail account-hijack pipeline driven by stolen session cookies. Exported helpers (waitForRemove...

OpenSSF/OSV malware advisory MAL-2026-10565 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10560 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5579 blocks this version. On `npm install`, package.json's `postinstall` hook runs `node -e "require('./loader.js')"`. loader.js spawns a detached no...

OpenSSF/OSV malware advisory MAL-2026-5580 blocks this version. On npm install, the package's postinstall hook runs loader.js, which hex-decodes the URL https://jsonkeeper.com/b/INN1F (an...

OpenSSF/OSV malware advisory MAL-2026-10554 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10568 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5460 blocks this version. fhirproxy@90.0.0 is a thin loader package whose only behavior is to pull and execute the dependency `fhirproxy-utils`. pack...

OpenSSF/OSV malware advisory MAL-2026-5461 blocks this version. On `npm install` (via the `prepare` lifecycle hook and many other lifecycle aliases) and on `require()`, index.js performs...

OpenSSF/OSV malware advisory MAL-2026-10548 blocks this version. When wired in as a @vercel/build-utils Builder and the exported build() runs in a Vercel deployment pipeline, index.js rea...

OpenSSF/OSV malware advisory MAL-2026-10548 blocks this version. When wired in as a @vercel/build-utils Builder and the exported build() runs in a Vercel deployment pipeline, index.js rea...

OpenSSF/OSV malware advisory MAL-2026-10627 blocks this version. index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement `var ins...