npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10318 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10316 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10312 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10313 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10326 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10311 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10324 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10269 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-6130 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball is a static-site / web-proxy build (index...

OpenSSF/OSV malware advisory MAL-2026-10274 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10356 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Any computer that has this package installed or runn...

OpenSSF/OSV malware advisory MAL-2026-5916 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball is not a Node library. `package.json` dec...

OpenSSF/OSV malware advisory MAL-2026-10359 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10317 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10309 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10307 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10293 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Any computer that has this package installed or runn...

OpenSSF/OSV malware advisory MAL-2026-10292 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10428 blocks this version. The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. in...

OpenSSF/OSV malware advisory MAL-2026-10391 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...