npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11109 blocks this version. The npm package `@wagni_bot/bsc` is a supply-chain credential stealer disguised as a **BNB Smart Chain (BSC)** SDK. It is...

OpenSSF/OSV malware advisory MAL-2026-11117 blocks this version. The npm package `@wagni_bot/web3` is a supply-chain credential stealer disguised as a **web3.js** SDK. It is one member of...

OpenSSF/OSV malware advisory MAL-2026-11116 blocks this version. The npm package `@wagni_bot/wagni` is a supply-chain credential stealer disguised as a **the campaign's own namesake handl...

OpenSSF/OSV malware advisory MAL-2026-11106 blocks this version. The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install a...

OpenSSF/OSV malware advisory MAL-2026-11107 blocks this version. Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install an...

OpenSSF/OSV malware advisory MAL-2026-11108 blocks this version. The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipelin...

OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...

OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...

OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...

OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...

OpenSSF/OSV malware advisory MAL-2026-2785 blocks this version. On `npm install`, the package's `preinstall` hook executes `index.js`, which collects host identifiers (os.hostname(), os.p...

OpenSSF/OSV malware advisory MAL-2026-2785 blocks this version. On `npm install`, the package's `preinstall` hook executes `index.js`, which collects host identifiers (os.hostname(), os.p...

OpenSSF/OSV malware advisory MAL-2025-190499 blocks this version. The package filifecycleserv-paypal was found to contain malicious code.

The import-time obfuscated installer creates a concrete remote-payload and persistence chain. Absence of an npm lifecycle hook does not mitigate execution when consumers import the defaul...

OpenSSF/OSV malware advisory MAL-2026-11093 blocks this version. The package's postinstall lifecycle hook runs `node index.js`, which issues an HTTPS GET to a hardcoded Burp Collaborator...

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

OpenSSF/OSV malware advisory MAL-2026-6563 blocks this version. Package presents itself as an 'analytics injection helper' with a no-op track() export, but its exported activate() functio...