npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10291 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10294 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10293 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10292 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6689 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dro...

OpenSSF/OSV malware advisory MAL-2026-6689 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dro...

OpenSSF/OSV malware advisory MAL-2026-10402 blocks this version. The package publishes under scope `@gleamkit/ws` while copying the `ws` package's description, homepage, repository, autho...

OpenSSF/OSV malware advisory MAL-2026-10407 blocks this version. awesome-terminal@1.0.3 ships a postinstall script (scripts/install-check.cjs) that resolves a bundle URL from a remote JSO...

OpenSSF/OSV malware advisory MAL-2026-10424 blocks this version. terminal-mascot@3.5.2 ships a postinstall script (install-check.cjs) that resolves a bundle URL from a remote JSON config...

OpenSSF/OSV malware advisory MAL-2026-10409 blocks this version. The package presents itself as a debugging utility but its exported API is a browser credential stealer targeting installe...