npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11469 blocks this version. lib/report.js imports child_process, fs, https and os, collects host and user identity data via os.hostname() and os.userI...

OpenSSF/OSV malware advisory MAL-2026-11468 blocks this version. lib/report.js collects host and user identifying data via os.hostname(), os.userInfo(), execSync-invoked system commands,...

OpenSSF/OSV malware advisory MAL-2026-11466 blocks this version. lib/report.js imports child_process, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via o...

OpenSSF/OSV malware advisory MAL-2026-11465 blocks this version. lib/report.js reads local files (fs.readFileSync at lines 31 and 72), collects host and account identifiers via os.hostnam...

OpenSSF/OSV malware advisory MAL-2026-11464 blocks this version. lib/report.js imports child_process, fs, https, and os and posts collected host information to a hardcoded https://hooks.z...

OpenSSF/OSV malware advisory MAL-2026-11463 blocks this version. lib/report.js in goldenflow-js@1.0.0 collects installer-side data using node's os, child_process, and fs modules (os.hostn...

OpenSSF/OSV malware advisory MAL-2026-11462 blocks this version. Package name typosquats the popular `fast-csv` CSV library but has no CSV functionality. `lib/report.js` collects the inst...

OpenSSF/OSV malware advisory MAL-2026-11459 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11458 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11457 blocks this version. Package name typosquats the legitimate @capacitor/assets. On postinstall (via postinstall.js invoking lib/report.js), the...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...

OpenSSF/OSV malware advisory MAL-2026-11460 blocks this version. lib/report.js imports child_process, fs, https, and os and collects host identity and environment data via os.hostname(),...

OpenSSF/OSV malware advisory MAL-2026-5390 blocks this version. On `npm install`, the package's postinstall.js script enumerates all of process.env and collects host identifiers (os.hostn...

OpenSSF/OSV malware advisory MAL-2026-5387 blocks this version. On `npm install`, this package automatically executes postinstall.js, which enumerates the entire process.env (every enviro...

OpenSSF/OSV malware advisory MAL-2026-5388 blocks this version. On `npm install`, postinstall.js enumerates the full process.env keyspace plus host identifiers (os.hostname(), username, h...

OpenSSF/OSV malware advisory MAL-2026-5389 blocks this version. On `npm install`, postinstall.js enumerates every entry in process.env (sorted), bundles it with hostname, username, homedi...

OpenSSF/OSV malware advisory MAL-2026-5391 blocks this version. On `npm install`, postinstall.js enumerates every process.env variable (including credentials such as AWS_*, NPM_TOKEN, GIT...

OpenSSF/OSV malware advisory MAL-2026-11467 blocks this version. lib/report.js imports child_process, fs, https, and os, collects host identity via os.hostname() and os.userInfo(), execut...

OpenSSF/OSV malware advisory MAL-2026-11467 blocks this version. lib/report.js imports child_process, fs, https, and os, collects host identity via os.hostname() and os.userInfo(), execut...

OpenSSF/OSV malware advisory MAL-2026-5386 blocks this version. On `npm install`, postinstall.js enumerates all of process.env, collects hostname, username, homedir, cwd, argv, platform/a...