npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10714 blocks this version. index.js (the package main) executes at require-time and performs credential and host exfiltration. It iterates process.en...

OpenSSF/OSV malware advisory MAL-2026-10704 blocks this version. The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of A...

OpenSSF/OSV malware advisory MAL-2026-10703 blocks this version. @across-toolkit/eslint-config@99.0.1 runs a postinstall.js script on npm install that harvests installer-side secrets and...

OpenSSF/OSV malware advisory MAL-2026-10700 blocks this version. On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated...

Source inspection confirms a concrete browser UI-hijacking and remotely controlled content-delivery chain. Although it has no install hook or local credential theft, the behavior is not c...

OpenSSF/OSV malware advisory MAL-2026-10704 blocks this version. The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of A...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. The package ships heavily obfuscated runtime files (dist/index.js, dist/launcher.js) built with javascript-obfuscator. The...

OpenSSF/OSV malware advisory MAL-2026-10735 blocks this version. On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.c...

Source and shipped bundles establish a concrete GET-triggered remote-download-and-write chain. The absence of install hooks does not mitigate this runtime malware behavior.

Source inspection confirms a concrete runtime remote-download-and-write chain, not merely a scanner similarity signal. The absence of lifecycle hooks does not mitigate the malicious behav...

Source inspection confirms concrete remote download-and-drop behavior unrelated to the package’s metrics API. Lack of lifecycle hooks limits activation to an explicit runtime call but doe...

Direct source inspection confirms an unsolicited install-time external network request. The package contains no legitimate implementation that would justify this behavior.

Source inspection confirms a concrete remote-content takeover on import, not merely a shell helper or scanner heuristic. This is a staged payload carrier whose destination can be rotated...

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-32206 blocks this version. The package rhynpm was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...

Concrete install-time execution performs credential/config exfiltration and remote SSH persistence. This is direct malicious behavior, not a package-aligned feature.

OpenSSF/OSV malware advisory MAL-2026-10514 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code