npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10203 blocks this version. The package declares a `preinstall` hook (`node index.js`) that runs automatically on `npm install`. index.js collects hos...

OpenSSF/OSV malware advisory MAL-2026-10206 blocks this version. Package advertises itself as an SVG fetcher/sanitizer but its main module also exports an undocumented getPlugin() functio...

OpenSSF/OSV malware advisory MAL-2026-10205 blocks this version. package.json declares `preinstall: node index.js`. On `npm install`, index.js collects installer host identity (os.hostnam...

OpenSSF/OSV malware advisory MAL-2026-10405 blocks this version. @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/he...

Source inspection confirms automatic, full-screen delivery of remotely controlled external content on import. No install hook is needed for this malicious runtime behavior.

OpenSSF/OSV malware advisory MAL-2026-10198 blocks this version. polylabel-web-lib@99.9.1 ships an empty index.js stub and declares its only runtime dependency as a direct tarball URL on...

OpenSSF/OSV malware advisory MAL-2026-10199 blocks this version. polymarket-kelly-math-stake@3.6.2 runs a postinstall script (scripts/install-check.cjs) that fetches a JSON config from ht...

OpenSSF/OSV malware advisory MAL-2026-10187 blocks this version. Supply-chain compromise of the official jscrambler npm client, a legitimate JavaScript obfuscation tool with roughly 60K d...

OpenSSF/OSV malware advisory MAL-2026-10419 blocks this version. notifications-broadcast@99.9.1 ships an empty index.js (`module.exports = {};`) with placeholder metadata (empty descripti...

OpenSSF/OSV malware advisory MAL-2026-10415 blocks this version. frontend-regulations@99.9.1 is a near-empty wrapper (index.js exports an empty object) whose package.json declares the dep...

OpenSSF/OSV malware advisory MAL-2026-10421 blocks this version. package.json declares the dependency 'ltidisafe' as a direct https tarball URL (https://ltidi.storage.googleapis.com/depen...

OpenSSF/OSV malware advisory MAL-2026-10422 blocks this version. sso-users-detection@99.9.1 is a hollow package (main exports `{}`, empty author/description, inflated 99.9.1 version) whos...

This package performs unverified install-time retrieval of executable and native-code payloads, then executes the retrieved binary. That is a concrete opaque remote-payload chain rather t...

OpenSSF/OSV malware advisory MAL-2026-6715 blocks this version. src/index.cjs exports getPlugin(), which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax...

OpenSSF/OSV malware advisory MAL-2026-10188 blocks this version. Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js -> run() -> p...

OpenSSF/OSV malware advisory MAL-2026-10187 blocks this version. Supply-chain compromise of the official jscrambler npm client, a legitimate JavaScript obfuscation tool with roughly 60K d...

OpenSSF/OSV malware advisory MAL-2026-10187 blocks this version. Supply-chain compromise of the official jscrambler npm client, a legitimate JavaScript obfuscation tool with roughly 60K d...

OpenSSF/OSV malware advisory MAL-2026-10186 blocks this version. google-caja-bower@1000.801.20 declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install...

OpenSSF/OSV malware advisory MAL-2026-10019 blocks this version. package.json declares postinstall=`node index.js`, which runs automatically on `npm install`. index.js collects host ident...

OpenSSF/OSV malware advisory MAL-2026-10184 blocks this version. index.js runs an async IIFE at module load that performs an outbound fetch to https://www.jsonkeeper.com/b/XVHGD (an anony...