npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10102 blocks this version. On `npm install`, postinstall.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://130.49.177.51:18080/p/dc-202...

OpenSSF/OSV malware advisory MAL-2026-10104 blocks this version. px8my's `main` entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL (`https...

OpenSSF/OSV malware advisory MAL-2026-10105 blocks this version. The package's main entry (pure.js) consists of a single behavior: it creates a <script> element pointing at https://cdn.js...

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-10021 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10021 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...

OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...

OpenSSF/OSV malware advisory MAL-2026-6260 blocks this version. This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrap...

OpenSSF/OSV malware advisory MAL-2026-10090 blocks this version. The package declares `gypfile: true` with no native C/C++ sources, and its binding.gyp abuses GYP command-expansion syntax...

OpenSSF/OSV malware advisory MAL-2026-6741 blocks this version. index.js unconditionally requires `@sql-trigger/nodesql` at the top of the main file (`var ins = require('@sql-trigger/node...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6285 blocks this version. Package new-solt@0.0.8 contains index.js which imports child_process and invokes execSync with bash and zsh shell strings (...