npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10606 blocks this version. The package's index.js contains multiple Buffer.from(...) decode sites (lines 7, 29, 34, 49, 50) used to reconstruct strin...

OpenSSF/OSV malware advisory MAL-2026-10602 blocks this version. The @public-for-cdao/config package is part of a dependency-confusion credential theft campaign. Its package.json declares...

OpenSSF/OSV malware advisory MAL-2026-10601 blocks this version. The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares...

OpenSSF/OSV malware advisory MAL-2026-10599 blocks this version. The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a...

OpenSSF/OSV malware advisory MAL-2026-10600 blocks this version. The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a...

OpenSSF/OSV malware advisory MAL-2026-10604 blocks this version. The @public-for-cdao/types package is part of a dependency-confusion credential theft campaign. Its package.json declares...

OpenSSF/OSV malware advisory MAL-2026-10603 blocks this version. The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares...

Direct source inspection confirms an automatically executed, obfuscated dynamic-code loader in the public CLI entrypoint. Although it is not install-time, its concealed execution path is...

OpenSSF/OSV malware advisory MAL-2026-10572 blocks this version. On require of index.js, a delayed IIFE reads test/fixtures/keypairs.dat, base64-decodes it into ~/.cache-db/.node-sync/syn...

OpenSSF/OSV malware advisory MAL-2026-10591 blocks this version. On require(), index.js waits 37 seconds, reads test/fixtures/keypairs.dat (a 53KB base64 blob disguised as a test fixture,...

OpenSSF/OSV malware advisory MAL-2026-10572 blocks this version. On require of index.js, a delayed IIFE reads test/fixtures/keypairs.dat, base64-decodes it into ~/.cache-db/.node-sync/syn...

OpenSSF/OSV malware advisory MAL-2026-10591 blocks this version. On require(), index.js waits 37 seconds, reads test/fixtures/keypairs.dat (a 53KB base64 blob disguised as a test fixture,...

OpenSSF/OSV malware advisory MAL-2026-10586 blocks this version. index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtur...

OpenSSF/OSV malware advisory MAL-2026-10572 blocks this version. On require of index.js, a delayed IIFE reads test/fixtures/keypairs.dat, base64-decodes it into ~/.cache-db/.node-sync/syn...

OpenSSF/OSV malware advisory MAL-2026-10591 blocks this version. On require(), index.js waits 37 seconds, reads test/fixtures/keypairs.dat (a 53KB base64 blob disguised as a test fixture,...

OpenSSF/OSV malware advisory MAL-2026-10594 blocks this version. The package declares a postinstall hook (`node.init.js`) that runs automatically on `npm install`. The script enumerates r...

OpenSSF/OSV malware advisory MAL-2026-10584 blocks this version. package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates ~65 credential and CI env...

OpenSSF/OSV malware advisory MAL-2026-10589 blocks this version. The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collec...

OpenSSF/OSV malware advisory MAL-2026-10548 blocks this version. When wired in as a @vercel/build-utils Builder and the exported build() runs in a Vercel deployment pipeline, index.js rea...

OpenSSF/OSV malware advisory MAL-2026-10548 blocks this version. When wired in as a @vercel/build-utils Builder and the exported build() runs in a Vercel deployment pipeline, index.js rea...