npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...

OpenSSF/OSV malware advisory MAL-2026-11542 blocks this version. The package's only exported function, sorgu(), invokes 26 sibling modules under public/a/b/.../z/ that carry out an immedi...

OpenSSF/OSV malware advisory MAL-2026-11548 blocks this version. The package advertises itself as a JavaScript day-math helper but its ESM main entry (dist/index.mjs) unconditionally spaw...

OpenSSF/OSV malware advisory MAL-2026-11541 blocks this version. package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively s...

OpenSSF/OSV malware advisory MAL-2026-11101 blocks this version. Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single ~105KB obfus...

OpenSSF/OSV malware advisory MAL-2026-11461 blocks this version. The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-ut...

OpenSSF/OSV malware advisory MAL-2026-11034 blocks this version. eth-slint is a typosquat of web3-core-subscriptions. src/index.js contains a clean 2119-byte copy of the legitimate web3.j...

OpenSSF/OSV malware advisory MAL-2026-11033 blocks this version. The package is advertised as an Ethereum ABI code generator but its `index.js` is a verbatim copy of the unrelated `mongoo...

OpenSSF/OSV malware advisory MAL-2026-11020 blocks this version. On module load, the package schedules a randomized 5-15 second setTimeout that POSTs a JSON body containing os.hostname(),...

OpenSSF/OSV malware advisory MAL-2026-11012 blocks this version. index.js is a heavily obfuscated loader (rotated string-array decoder, control-flow flattening, self-defending/console-tam...

OpenSSF/OSV malware advisory MAL-2026-11012 blocks this version. index.js is a heavily obfuscated loader (rotated string-array decoder, control-flow flattening, self-defending/console-tam...

OpenSSF/OSV malware advisory MAL-2026-11012 blocks this version. index.js is a heavily obfuscated loader (rotated string-array decoder, control-flow flattening, self-defending/console-tam...

OpenSSF/OSV malware advisory MAL-2026-10971 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. cxpw-offers ships an empty index.js and declares its...

OpenSSF/OSV malware advisory MAL-2026-11017 blocks this version. vectormark@1.0.0 advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function...

OpenSSF/OSV malware advisory MAL-2026-11033 blocks this version. The package is advertised as an Ethereum ABI code generator but its `index.js` is a verbatim copy of the unrelated `mongoo...

OpenSSF/OSV malware advisory MAL-2026-11033 blocks this version. The package is advertised as an Ethereum ABI code generator but its `index.js` is a verbatim copy of the unrelated `mongoo...

OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...

OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...

OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...

OpenSSF/OSV malware advisory MAL-2026-10935 blocks this version. The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user '...