npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-10161 blocks this version. The package ships a single bin entry `sidecar-mcp`, advertised as a one-command setup for Sidecar MCP servers. When the us...

OpenSSF/OSV malware advisory MAL-2026-10161 blocks this version. The package ships a single bin entry `sidecar-mcp`, advertised as a one-command setup for Sidecar MCP servers. When the us...

OpenSSF/OSV malware advisory MAL-2026-10161 blocks this version. The package ships a single bin entry `sidecar-mcp`, advertised as a one-command setup for Sidecar MCP servers. When the us...

OpenSSF/OSV malware advisory MAL-2026-10150 blocks this version. Package 'ap3-components-ui' at version 9.999.0 declares a preinstall hook ("node index.js > /dev/null 2>&1") that shells o...

OpenSSF/OSV malware advisory MAL-2026-6546 blocks this version. ryan-pdf-js@99.9.1 is an empty stub package (index.js exports {}) whose sole purpose is to deliver an off-registry payload...

OpenSSF/OSV malware advisory MAL-2026-5517 blocks this version. firefly-utilities-helper@99.9.1 ships an empty stub (index.js: `module.exports = {};`) with no description, author, or repo...

OpenSSF/OSV malware advisory MAL-2026-5487 blocks this version. tailwind-form is a typosquat of the legitimate @tailwindcss/forms plugin (README and repository field are copied from tailw...

OpenSSF/OSV malware advisory MAL-2026-3312 blocks this version. On require(), path.js executes an IIFE that calls loadTokenData(), which fetches a base64-obfuscated URL (decoding to https...

OpenSSF/OSV malware advisory MAL-2026-5448 blocks this version. package.json declares its only dependency `ltidisafe` as a direct HTTPS tarball URL (`https://ltidi.storage.googleapis.com/...

OpenSSF/OSV malware advisory MAL-2026-5447 blocks this version. localization-lib@99.9.1 is an empty shell package: `index.js` is `module.exports = {}` and `package.json` has no descriptio...

OpenSSF/OSV malware advisory MAL-2026-5446 blocks this version. housecall-ui@99.9.1 is a hollow npm package (empty description, empty author, index.js exports an empty object) whose sole...

OpenSSF/OSV malware advisory MAL-2026-5438 blocks this version. corporate-front-vue@99.9.1 is a near-empty shim (index.js exports an empty object) whose only meaningful content is a tarba...

OpenSSF/OSV malware advisory MAL-2026-5437 blocks this version. commons-ui-styles@99.9.1 is an empty placeholder package (index.js exports `{}`, description/author blank, version bumped t...

OpenSSF/OSV malware advisory MAL-2026-5451 blocks this version. privacy-sdk@99.9.1 is a hollow wrapper (index.js is `module.exports = {}`, blank description, blank author) whose sole runt...

OpenSSF/OSV malware advisory MAL-2026-5488 blocks this version. Package impersonates the popular pino logger (homepage points to getpino.io, description mimics pino's tagline) and execute...

OpenSSF/OSV malware advisory MAL-2026-6746 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-6746 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-6746 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...