npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11478 blocks this version. Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExte...

OpenSSF/OSV malware advisory MAL-2026-10957 blocks this version. The iphouse package was published to the npm registry by user 'jonothhu' (maintainer email bruemleveroger@gmail.com) as on...

OpenSSF/OSV malware advisory MAL-2026-10923 blocks this version. package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPu...

OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...

OpenSSF/OSV malware advisory MAL-2026-10767 blocks this version. The syft-acp-util package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part...

OpenSSF/OSV malware advisory MAL-2026-10766 blocks this version. The syft-acp-uikit package was published to the npm registry by user 'ada8877' (maintainer email k3mlol@proton.me) as part...

OpenSSF/OSV malware advisory MAL-2026-11473 blocks this version. LPM AI assessed this version as clean; the assessments disagree. metrics-ui is a functionally empty npm package (hollow in...

OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...

OpenSSF/OSV malware advisory MAL-2026-10696 blocks this version. The npm package's only file of substance is index.html (declared as `main` in package.json). When opened in a browser, the...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10697 blocks this version. The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ (with header x-access: p2p)...

OpenSSF/OSV malware advisory MAL-2026-11087 blocks this version. The package's main entry (src/server.js) is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes...

OpenSSF/OSV malware advisory MAL-2026-11512 blocks this version. The package's main module exports a function `command()` that invokes `/bin/bash -c` to fetch a script from reverse-shell....

OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...

OpenSSF/OSV malware advisory MAL-2026-11531 blocks this version. On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance...

OpenSSF/OSV malware advisory MAL-2026-11530 blocks this version. The package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.j...

OpenSSF/OSV malware advisory MAL-2026-11533 blocks this version. This package impersonates Solana Labs (author field 'solana-labs', repository pointing at github.com/solana-labs/solana-we...

OpenSSF/OSV malware advisory MAL-2026-11532 blocks this version. The postinstall.js script, which runs automatically on `npm install`, harvests a broad set of installer-owned secrets and...

OpenSSF/OSV malware advisory MAL-2026-11529 blocks this version. postinstall.js runs automatically on `npm install` and enumerates installer-owned secret material: SSH private keys under...

OpenSSF/OSV malware advisory MAL-2026-11534 blocks this version. The package impersonates XRPLF's xrp-lib (author metadata and homepage point at github.com/XRPLF/xrp-lib) while being publ...

OpenSSF/OSV malware advisory MAL-2026-11528 blocks this version. The package's preinstall lifecycle script (preinstall.js) opens a TCP socket to the hardcoded remote host 120.55.170.103:8...