npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6795 blocks this version. Package zod-pino444@1.0.131 is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-a...

OpenSSF/OSV malware advisory MAL-2026-6952 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6952 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6954 blocks this version. On `npm install`, the package's postinstall hook (`scripts.postinstall: node index.js`) auto-executes index.js, which build...

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6930 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...

OpenSSF/OSV malware advisory MAL-2026-6586 blocks this version. Package name mimics Yandex's `yastatic` static-asset namespace. On install, postinstall.js performs an unconditional plain-...

OpenSSF/OSV malware advisory MAL-2026-6586 blocks this version. Package name mimics Yandex's `yastatic` static-asset namespace. On install, postinstall.js performs an unconditional plain-...

OpenSSF/OSV malware advisory MAL-2026-6586 blocks this version. Package name mimics Yandex's `yastatic` static-asset namespace. On install, postinstall.js performs an unconditional plain-...

OpenSSF/OSV malware advisory MAL-2026-6585 blocks this version. On `npm install`, the package's postinstall hook (`scripts/install-check.cjs`, wired via package.json `scripts.postinstall`...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6547 blocks this version. package.json declares a preinstall hook `node src/utils/index.d.js`, but the published tarball's `files` whitelist ships on...

OpenSSF/OSV malware advisory MAL-2026-6547 blocks this version. package.json declares a preinstall hook `node src/utils/index.d.js`, but the published tarball's `files` whitelist ships on...

OpenSSF/OSV malware advisory MAL-2026-6547 blocks this version. package.json declares a preinstall hook `node src/utils/index.d.js`, but the published tarball's `files` whitelist ships on...

OpenSSF/OSV malware advisory MAL-2026-6547 blocks this version. package.json declares a preinstall hook `node src/utils/index.d.js`, but the published tarball's `files` whitelist ships on...

OpenSSF/OSV malware advisory MAL-2026-6547 blocks this version. package.json declares a preinstall hook `node src/utils/index.d.js`, but the published tarball's `files` whitelist ships on...