npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10214 blocks this version. LPM AI assessed this version as clean; the assessments disagree. index.js, the package main, runs a load-time IIFE that co...

OpenSSF/OSV malware advisory MAL-2026-10440 blocks this version. The package presents itself as a logger (module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files pr...

OpenSSF/OSV malware advisory MAL-2026-10459 blocks this version. The package's `scripts.install` lifecycle hook runs `node index.js`, which loads `lib/core.js`. That module collects the i...

OpenSSF/OSV malware advisory MAL-2026-10458 blocks this version. compliancepolicyserv@9.9.11 registers index.js as both scripts.install and main. On npm install and on require, index.js l...

OpenSSF/OSV malware advisory MAL-2026-10464 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. node-procmetrics-data@1.0.1 ships archive-sender.js...

OpenSSF/OSV malware advisory MAL-2026-10461 blocks this version. The package's npm preinstall lifecycle script (preinstall.js, referenced from package.json's "preinstall": "node preinstal...

OpenSSF/OSV malware advisory MAL-2026-10463 blocks this version. node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry (path.js) delegates...

OpenSSF/OSV malware advisory MAL-2026-10457 blocks this version. cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolv...

OpenSSF/OSV malware advisory MAL-2026-10462 blocks this version. Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code...

OpenSSF/OSV malware advisory MAL-2026-10456 blocks this version. The package advertises itself as a skill usage/error logger but, when activated via the openclaw gateway_start hook, opens...

OpenSSF/OSV malware advisory MAL-2026-10456 blocks this version. The package advertises itself as a skill usage/error logger but, when activated via the openclaw gateway_start hook, opens...

OpenSSF/OSV malware advisory MAL-2026-10456 blocks this version. The package advertises itself as a skill usage/error logger but, when activated via the openclaw gateway_start hook, opens...

OpenSSF/OSV malware advisory MAL-2026-10455 blocks this version. @origindev/ethaccount@1.0.0 ships a single heavily obfuscated index.js wrapped in an RC4 string-array decoder with IIFE ro...

OpenSSF/OSV malware advisory MAL-2026-10455 blocks this version. @origindev/ethaccount@1.0.0 ships a single heavily obfuscated index.js wrapped in an RC4 string-array decoder with IIFE ro...

OpenSSF/OSV malware advisory MAL-2026-10440 blocks this version. The package presents itself as a logger (module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files pr...

OpenSSF/OSV malware advisory MAL-2026-10452 blocks this version. The package's package.json declares a preinstall hook (`node index.d.js`) that runs automatically on `npm install`. The sc...

OpenSSF/OSV malware advisory MAL-2026-10452 blocks this version. The package's package.json declares a preinstall hook (`node index.d.js`) that runs automatically on `npm install`. The sc...

OpenSSF/OSV malware advisory MAL-2026-10451 blocks this version. Package name typosquats the legitimate `gifuct-js` GIF parser and re-exports it as cover. On module load, code reconstruct...

OpenSSF/OSV malware advisory MAL-2026-10448 blocks this version. On require/import, index.js fetches the content of a GitHub Gist (https://gist.github.com/getchainverse/b57a92378ad0a52430...

OpenSSF/OSV malware advisory MAL-2026-10445 blocks this version. node-procmetrics is a malicious npm package. It is a throwaway, zero-download, no-repository package using a "process-metr...

OpenSSF/OSV malware advisory MAL-2026-10446 blocks this version. react-markable-table@2.4.10 is a typosquat of markdown-table (declared repo field `wooorm/markdown-table`). package.json d...