npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6585 blocks this version. On `npm install`, the package's postinstall hook (`scripts/install-check.cjs`, wired via package.json `scripts.postinstall`...

OpenSSF/OSV malware advisory MAL-2026-6584 blocks this version. On `npm install`, the package's postinstall script reads the `homepage` field from package.json (set to https://data-stream...

OpenSSF/OSV malware advisory MAL-2026-6584 blocks this version. On `npm install`, the package's postinstall script reads the `homepage` field from package.json (set to https://data-stream...

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...

OpenSSF/OSV malware advisory MAL-2026-6309 blocks this version. @nullzero/urlcat (version 1.4.2, published by nullzero-rlnozk@wshu.net) is a trojanized npm package belonging to the wshu.n...

OpenSSF/OSV malware advisory MAL-2026-6335 blocks this version. package.json declares `postinstall: node test.js`, but test.js is not present in the tarball — installation fails with MODU...

OpenSSF/OSV malware advisory MAL-2025-191440 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6143 blocks this version. On install, postinstall.js executes automatically and exfiltrates host reconnaissance data to attacker-controlled subdomain...

OpenSSF/OSV malware advisory MAL-2026-6333 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...

OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...

OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...

OpenSSF/OSV malware advisory MAL-2025-191134 blocks this version. No a static rule matches and no traced-code findings of installer-side attack behavior were produced for this package ver...