npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10521 blocks this version. @flcik/flick.js@3.1.2 replicates the discord.js public API surface (FlickClient, GatewayIntentBits, SlashCommandBuilder, B...

OpenSSF/OSV malware advisory MAL-2026-10521 blocks this version. @flcik/flick.js@3.1.2 replicates the discord.js public API surface (FlickClient, GatewayIntentBits, SlashCommandBuilder, B...

OpenSSF/OSV malware advisory MAL-2026-10134 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. stella-cli/telegram-bot.mjs hardcodes a Telegram bot...

OpenSSF/OSV malware advisory MAL-2026-10506 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package tarball ships archive-sender.js, which a...

OpenSSF/OSV malware advisory MAL-2026-10506 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package tarball ships archive-sender.js, which a...

OpenSSF/OSV malware advisory MAL-2026-10571 blocks this version. Package `@wrenfield/viem` impersonates the popular `viem` library (homepage viem.sh, repo wevm/viem); README and authors f...

OpenSSF/OSV malware advisory MAL-2026-10386 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5462 blocks this version. @rockawayx/utils squats the unclaimed @rockawayx npm scope and runs a preinstall beacon on every install. package.json decl...

OpenSSF/OSV malware advisory MAL-2026-5150 blocks this version. On `npm install`, the package's preinstall script (preinstall.js) collects the installer's hostname, OS username, current w...

OpenSSF/OSV malware advisory MAL-2026-10531 blocks this version. The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, th...

OpenSSF/OSV malware advisory MAL-2026-10530 blocks this version. On module load, the package's main entrypoint shells out via child_process.exec to run `cat /etc/passwd` and prints the co...

OpenSSF/OSV malware advisory MAL-2026-10544 blocks this version. Package publishes as `skrill-sdk` and exposes a `PaysafeClient` API (payments.create/get, customers.create/get) that mimic...

OpenSSF/OSV malware advisory MAL-2026-10543 blocks this version. Package impersonates a Paysafe/Skrill payments SDK (name 'skrill-payments', class PaysafeClient, spoofed 'github.com/paysa...

OpenSSF/OSV malware advisory MAL-2026-10542 blocks this version. Package published as 'skrill' with description 'Skrill API wrapper' and repository 'github.com/paysafe/skrill' impersonate...

OpenSSF/OSV malware advisory MAL-2026-10538 blocks this version. Package name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/...

OpenSSF/OSV malware advisory MAL-2026-10534 blocks this version. motion-pull@2.3.5 impersonates the pino logger (exports `module.exports.pino = middleware`, uses logger-themed keywords, s...

OpenSSF/OSV malware advisory MAL-2026-10546 blocks this version. The npm package 'viteplugiin' impersonates '@base44/viteplugin' via a one-character insertion (doubled 'i') and ships a ho...

OpenSSF/OSV malware advisory MAL-2026-10537 blocks this version. neon-postgres is a clone of the porsager/postgres client with package metadata (repository, author, homepage) still pointi...

OpenSSF/OSV malware advisory MAL-2026-10537 blocks this version. neon-postgres is a clone of the porsager/postgres client with package metadata (repository, author, homepage) still pointi...

OpenSSF/OSV malware advisory MAL-2026-10533 blocks this version. package.json declares the `node-fetch` dependency pinned to a tarball URL on `registry.ctzbg.com`, a host unrelated to the...