npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10482 blocks this version. index.js stores base64-encoded literals (`svgValidateKey`, `svgValidatePattern`) that decode to the shell command `npm ins...

OpenSSF/OSV malware advisory MAL-2026-10482 blocks this version. index.js stores base64-encoded literals (`svgValidateKey`, `svgValidatePattern`) that decode to the shell command `npm ins...

OpenSSF/OSV malware advisory MAL-2026-10478 blocks this version. The package advertises a single function `module.exports = function hello(name)` but ships a `preinstall.js` lifecycle scr...

OpenSSF/OSV malware advisory MAL-2026-10487 blocks this version. On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify AP...

OpenSSF/OSV malware advisory MAL-2026-10443 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares the dependency `ltidisafe` as...

OpenSSF/OSV malware advisory MAL-2026-10431 blocks this version. Package is published as an ESLint plugin for Tailwind CSS v4, but the shipped code implements unrelated Polymarket Kelly s...

OpenSSF/OSV malware advisory MAL-2026-10431 blocks this version. Package is published as an ESLint plugin for Tailwind CSS v4, but the shipped code implements unrelated Polymarket Kelly s...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10473 blocks this version. On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with...

OpenSSF/OSV malware advisory MAL-2026-10473 blocks this version. On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10472 blocks this version. The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info,...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-10470 blocks this version. The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author ('E...

OpenSSF/OSV malware advisory MAL-2026-10469 blocks this version. When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environm...

OpenSSF/OSV malware advisory MAL-2026-10471 blocks this version. Package name impersonates the pino logger (exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js...

OpenSSF/OSV malware advisory MAL-2026-10214 blocks this version. LPM AI assessed this version as clean; the assessments disagree. index.js, the package main, runs a load-time IIFE that co...

OpenSSF/OSV malware advisory MAL-2026-10440 blocks this version. The package presents itself as a logger (module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files pr...

OpenSSF/OSV malware advisory MAL-2026-10459 blocks this version. The package's `scripts.install` lifecycle hook runs `node index.js`, which loads `lib/core.js`. That module collects the i...

OpenSSF/OSV malware advisory MAL-2026-10458 blocks this version. compliancepolicyserv@9.9.11 registers index.js as both scripts.install and main. On npm install and on require, index.js l...