npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6574 blocks this version. yandex-geobase@3.9.0 squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTT...

OpenSSF/OSV malware advisory MAL-2026-6574 blocks this version. yandex-geobase@3.9.0 squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTT...

OpenSSF/OSV malware advisory MAL-2026-6574 blocks this version. yandex-geobase@3.9.0 squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTT...

OpenSSF/OSV malware advisory MAL-2026-6584 blocks this version. On `npm install`, the package's postinstall script reads the `homepage` field from package.json (set to https://data-stream...

OpenSSF/OSV malware advisory MAL-2026-6924 blocks this version. The package name resembles utilities in the Solana ecosystem (e.g., @solana/addresses and address codec helpers), which is...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-6506 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6288 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6693 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `thirdwb` is a typosquat of the...

OpenSSF/OSV malware advisory MAL-2026-6287 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6278 blocks this version. Package is published under the name `ts-wross` but its package.json claims authorship by Michael Mclaughlin (M8ch88l@gmail....

OpenSSF/OSV malware advisory MAL-2026-6199 blocks this version. ts-big-ecro is a verbatim copy of the legitimate big.js library (MikeMcl/big.js v7.0.1) with its name, repository field, an...

OpenSSF/OSV malware advisory MAL-2026-6538 blocks this version. On every Model instantiation — the package's documented primary API — dist/index.js executes `execSync('npm install db-conn...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5888 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5791 blocks this version. On require('mddriver'), an IIFE in index.js invokes loadTokenData(), which fetches https://www.jsonkeeper.com/b/C4H0M (stor...

OpenSSF/OSV malware advisory MAL-2026-5851 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5851 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code