npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10301 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10396 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10282 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-10237 blocks this version. The tme-xca-react package was published to the npm registry by user 'click2ai' (maintainer email privatek3m@protonmail.com...

OpenSSF/OSV malware advisory MAL-2026-10134 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. stella-cli/telegram-bot.mjs hardcodes a Telegram bot...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-10572 blocks this version. On require of index.js, a delayed IIFE reads test/fixtures/keypairs.dat, base64-decodes it into ~/.cache-db/.node-sync/syn...

OpenSSF/OSV malware advisory MAL-2026-10444 blocks this version. markable-table@3.1.8 declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and in...

OpenSSF/OSV malware advisory MAL-2026-10477 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10476 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10477 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10476 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10474 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...

OpenSSF/OSV malware advisory MAL-2026-10477 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10476 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code