npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10499 blocks this version. Package eth-lib-utils@5.2.3 impersonates @ethereumjs/util / ethereumjs-util (README, author list, repository URL, and sour...

OpenSSF/OSV malware advisory MAL-2026-10502 blocks this version. The package advertises itself as a trading-gamification library (XP, leaderboards, updateProgress/getLeaderboard) but its...

OpenSSF/OSV malware advisory MAL-2026-10501 blocks this version. The package presents itself as a date-formatting utility and re-exports plausible date APIs (format, formatISO, formatDate...

OpenSSF/OSV malware advisory MAL-2026-10501 blocks this version. The package presents itself as a date-formatting utility and re-exports plausible date APIs (format, formatISO, formatDate...

OpenSSF/OSV malware advisory MAL-2026-10500 blocks this version. express-bunker@6.1.0 ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP (http://1...

OpenSSF/OSV malware advisory MAL-2026-10496 blocks this version. package.json declares a postinstall hook that runs the package's only code file, index.js, on every npm install. index.js...

OpenSSF/OSV malware advisory MAL-2026-10503 blocks this version. On require by n8n (module-load, top-level code in dist/RceNode.node.js), the package runs a shell command via execSync('/b...

OpenSSF/OSV malware advisory MAL-2026-10494 blocks this version. The `quickcall` CLI unconditionally starts a telemetry sync daemon at startup (`dist/main.js` invokes `startSyncDaemon()`...

OpenSSF/OSV malware advisory MAL-2026-10495 blocks this version. The package is a remote-controlled bridge: after the user runs `opencode-clawmessenger setup` and binds via QR code, the i...

OpenSSF/OSV malware advisory MAL-2026-10492 blocks this version. font-huge advertises itself as a font/icon collection, but its exported getPlugin function fetches https://svganchordev.ne...

OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...

This is a concrete remote payload delivery mechanism disguised as a package entrypoint, not a benign library behavior. No install hook is needed for the attack to activate when consumers...

OpenSSF/OSV malware advisory MAL-2026-10490 blocks this version. The package's main entry point (index.js) fetches a hardcoded GitHub Gist owned by 'getchainverse' via api.github.com and...

OpenSSF/OSV malware advisory MAL-2026-10491 blocks this version. assertcoreutils impersonates the popular `chai` assertion library: the README, the `chai` keyword, the `lib/chai/` directo...

OpenSSF/OSV malware advisory MAL-2026-10491 blocks this version. assertcoreutils impersonates the popular `chai` assertion library: the README, the `chai` keyword, the `lib/chai/` directo...

OpenSSF/OSV malware advisory MAL-2026-10488 blocks this version. On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserver_s...

OpenSSF/OSV malware advisory MAL-2026-10489 blocks this version. The package's `main` (index.js) is a 10-line FFI shim that spawns a worker, dlopens the bundled `lib-linux.so` via koffi,...

OpenSSF/OSV malware advisory MAL-2026-10489 blocks this version. The package's `main` (index.js) is a 10-line FFI shim that spawns a worker, dlopens the bundled `lib-linux.so` via koffi,...

OpenSSF/OSV malware advisory MAL-2026-10489 blocks this version. The package's `main` (index.js) is a 10-line FFI shim that spawns a worker, dlopens the bundled `lib-linux.so` via koffi,...

OpenSSF/OSV malware advisory MAL-2026-10483 blocks this version. The package's default export builds a URL from split constants (protocol/separator/domain/path/token resolving to https://...