npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10932 blocks this version. The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by...

OpenSSF/OSV malware advisory MAL-2026-10937 blocks this version. The twilio-serverless package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace publishe...

OpenSSF/OSV malware advisory MAL-2026-10944 blocks this version. The zer0onetencent package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com...

OpenSSF/OSV malware advisory MAL-2026-10941 blocks this version. The aftermath-finance package was published to the npm registry by user 'jet0010001' (maintainer email bremagml0002@gmail....

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On first invocation of `npx claude-cup` (and on every...

OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...

OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...

OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...

OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...

OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...

OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...

OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...

OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...

OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...

OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...

OpenSSF/OSV malware advisory MAL-2026-7008 blocks this version. chai-as-const@1.4.5 is a disguised dropper. The package name is unrelated to its code, which impersonates the `pino` logger...

OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...

OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...

The preinstall hook executes a concealed, credential-aware payload unrelated to the chat UI package. Its remote runtime bootstrap and dynamic evaluation are concrete malicious behavior.