npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10375 blocks this version. The package declares no install/postinstall/preinstall lifecycle scripts, and its declared `main` is `sw.js` — a browser S...

OpenSSF/OSV malware advisory MAL-2026-10374 blocks this version. The package declares no install/postinstall/preinstall lifecycle scripts, and its declared `main` is `sw.js` — a browser S...

OpenSSF/OSV malware advisory MAL-2026-10390 blocks this version. Package is not a Node library — `package.json` declares `main: sw.js`, a browser Service Worker whose first line calls `im...

OpenSSF/OSV malware advisory MAL-2026-10389 blocks this version. This package is not a Node.js library. `package.json` declares `"main": "sw.js"`, a Service Worker that calls `importScrip...

OpenSSF/OSV malware advisory MAL-2026-10388 blocks this version. The package ships twelve heavily obfuscated JavaScript files under assets/ (e.g. assets/3oruu3por5.js, assets/6y4sp7rdhb.j...

OpenSSF/OSV malware advisory MAL-2026-10370 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10369 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10368 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10367 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10369 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10368 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10367 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10432 blocks this version. The package presents itself as a PostCSS plugin for animate.css, but its main export (src/plugin.js `createPlugin`) synchr...

OpenSSF/OSV malware advisory MAL-2026-10268 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10227 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The box-react-uix package was published to the npm r...

OpenSSF/OSV malware advisory MAL-2026-10235 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tme-error package was published to the npm regis...

OpenSSF/OSV malware advisory MAL-2026-10268 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10273 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10281 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10320 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...