npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5529 blocks this version. Package impersonates axios v0.18.0 (index.js carries the genuine `axios v0.18.0 | (c) 2018 by Matt Zabriskie` header and se...

OpenSSF/OSV malware advisory MAL-2026-5529 blocks this version. Package impersonates axios v0.18.0 (index.js carries the genuine `axios v0.18.0 | (c) 2018 by Matt Zabriskie` header and se...

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

OpenSSF/OSV malware advisory MAL-2026-5547 blocks this version. On require(), index.js executes an immediately-invoked function that platform-gates to macOS, skips CI environments, drops...

OpenSSF/OSV malware advisory MAL-2026-5549 blocks this version. On require(), index.js runs an IIFE that gates to macOS, skips when CI or GITHUB_ACTIONS is set, waits 30-90 seconds, and w...

OpenSSF/OSV malware advisory MAL-2026-5548 blocks this version. On require('@403name/ether-js'), index.js runs an IIFE that targets macOS only (returns early on non-darwin and when CI/GIT...

OpenSSF/OSV malware advisory MAL-2026-5547 blocks this version. On require(), index.js executes an immediately-invoked function that platform-gates to macOS, skips CI environments, drops...

OpenSSF/OSV malware advisory MAL-2026-5549 blocks this version. On require(), index.js runs an IIFE that gates to macOS, skips when CI or GITHUB_ACTIONS is set, waits 30-90 seconds, and w...

OpenSSF/OSV malware advisory MAL-2026-5548 blocks this version. On require('@403name/ether-js'), index.js runs an IIFE that targets macOS only (returns early on non-darwin and when CI/GIT...

OpenSSF/OSV malware advisory MAL-2026-5554 blocks this version. On install, the package's postinstall hook (scripts/inject.js) locates the installer's project root and main entry (from pa...

OpenSSF/OSV malware advisory MAL-2026-5553 blocks this version. On `npm install`, the package's `postinstall` hook (`node scripts/inject.js`) walks up from the install directory to locate...

OpenSSF/OSV malware advisory MAL-2026-5552 blocks this version. On `npm install`, the package's `postinstall` runs `scripts/inject.js`, which walks up from the current working directory t...

OpenSSF/OSV malware advisory MAL-2026-5551 blocks this version. On `npm install`, the package's postinstall script (scripts/inject.js) locates the consumer project's main Express entry fi...

OpenSSF/OSV malware advisory MAL-2026-5550 blocks this version. On `npm install`, the package's postinstall hook (`scripts/inject.js`) locates the installer's host project root, identifie...

OpenSSF/OSV malware advisory MAL-2026-11072 blocks this version. The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path (via __filename with se...

OpenSSF/OSV malware advisory MAL-2026-11071 blocks this version. whs4_eud@1.0.1 declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On e...