npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10625 blocks this version. Package @leviosa86com/leviosa86-test@5.999.0 ships src/poc/index.js which shells out via child_process.exec to collect hos...

OpenSSF/OSV malware advisory MAL-2026-10625 blocks this version. Package @leviosa86com/leviosa86-test@5.999.0 ships src/poc/index.js which shells out via child_process.exec to collect hos...

OpenSSF/OSV malware advisory MAL-2026-10625 blocks this version. Package @leviosa86com/leviosa86-test@5.999.0 ships src/poc/index.js which shells out via child_process.exec to collect hos...

OpenSSF/OSV malware advisory MAL-2026-10625 blocks this version. Package @leviosa86com/leviosa86-test@5.999.0 ships src/poc/index.js which shells out via child_process.exec to collect hos...

OpenSSF/OSV malware advisory MAL-2026-10622 blocks this version. The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware fact...

OpenSSF/OSV malware advisory MAL-2026-10613 blocks this version. Package ethereum-lib-utils@1.3.7 impersonates the widely-used ethereumjs-util library: the package name, README badge, rep...

OpenSSF/OSV malware advisory MAL-2026-10614 blocks this version. Package is published as `postcss-selector-minify` (a word-order permutation of cssnano's widely used `postcss-minify-selec...

OpenSSF/OSV malware advisory MAL-2026-10612 blocks this version. assertion-utils-js is a typosquat of chai (name, description, and keywords mirror the real package). On require(), index.j...

OpenSSF/OSV malware advisory MAL-2026-10611 blocks this version. At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.en...

OpenSSF/OSV malware advisory MAL-2026-10611 blocks this version. At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.en...

OpenSSF/OSV malware advisory MAL-2026-10611 blocks this version. At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.en...

OpenSSF/OSV malware advisory MAL-2026-10611 blocks this version. At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.en...

OpenSSF/OSV malware advisory MAL-2026-10611 blocks this version. At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.en...

OpenSSF/OSV malware advisory MAL-2026-10489 blocks this version. The package's `main` (index.js) is a 10-line FFI shim that spawns a worker, dlopens the bundled `lib-linux.so` via koffi,...

OpenSSF/OSV malware advisory MAL-2026-10608 blocks this version. chain-sdk-js is a typosquat of @thetalabs/theta-js (package name, description, author 'Theta Labs', and bundle filenames t...

OpenSSF/OSV malware advisory MAL-2026-10586 blocks this version. index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtur...

OpenSSF/OSV malware advisory MAL-2026-10586 blocks this version. index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtur...

OpenSSF/OSV malware advisory MAL-2026-10609 blocks this version. The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers (os.hostname(...

OpenSSF/OSV malware advisory MAL-2026-10607 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package masquerades as a chai plugin but ships t...

OpenSSF/OSV malware advisory MAL-2026-10608 blocks this version. chain-sdk-js is a typosquat of @thetalabs/theta-js (package name, description, author 'Theta Labs', and bundle filenames t...