npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10369 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10368 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10367 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10432 blocks this version. The package presents itself as a PostCSS plugin for animate.css, but its main export (src/plugin.js `createPlugin`) synchr...

OpenSSF/OSV malware advisory MAL-2026-10268 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10227 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The box-react-uix package was published to the npm r...

OpenSSF/OSV malware advisory MAL-2026-10235 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tme-error package was published to the npm regis...

OpenSSF/OSV malware advisory MAL-2026-10268 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10273 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10281 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10320 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10325 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10268 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10273 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10281 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10320 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10325 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-5918 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. This package is one of ~95 names in a coordinated spa...

OpenSSF/OSV malware advisory MAL-2026-10323 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10315 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Any computer that has this package installed or runn...