npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10437 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package jsonfb@1.1.0 is presented as a JSON.parse bi...

OpenSSF/OSV malware advisory MAL-2026-10651 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10661 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10540 blocks this version. On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs unde...

OpenSSF/OSV malware advisory MAL-2026-10661 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10661 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10659 blocks this version. Package name impersonates Open Whisper Systems' libsignal-node but ships unrelated code. On require() of index.js, after a...

OpenSSF/OSV malware advisory MAL-2026-10540 blocks this version. On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs unde...

OpenSSF/OSV malware advisory MAL-2026-10540 blocks this version. On require, src/index.js loads src/token-loader.js, which reads data/design-tokens.json, XOR-decodes the base64 blobs unde...

OpenSSF/OSV malware advisory MAL-2026-10653 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10648 blocks this version. The package has no real functionality — index.js only exports `{ ok: true }` — and its sole effect is to run a postinstall...

OpenSSF/OSV malware advisory MAL-2026-10437 blocks this version. Package jsonfb@1.1.0 is presented as a JSON.parse bigint helper (mimicking json-bigint, and re-using the real json-bigint...

OpenSSF/OSV malware advisory MAL-2026-10437 blocks this version. Package jsonfb@1.1.0 is presented as a JSON.parse bigint helper (mimicking json-bigint, and re-using the real json-bigint...

OpenSSF/OSV malware advisory MAL-2026-10437 blocks this version. Package jsonfb@1.1.0 is presented as a JSON.parse bigint helper (mimicking json-bigint, and re-using the real json-bigint...

OpenSSF/OSV malware advisory MAL-2026-10668 blocks this version. chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time (whe...

OpenSSF/OSV malware advisory MAL-2026-10463 blocks this version. node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry (path.js) delegates...

OpenSSF/OSV malware advisory MAL-2026-6302 blocks this version. The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js fork...

OpenSSF/OSV malware advisory MAL-2026-6302 blocks this version. The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js fork...

OpenSSF/OSV malware advisory MAL-2026-6302 blocks this version. The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js fork...

OpenSSF/OSV malware advisory MAL-2026-6302 blocks this version. The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js fork...