npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...

OpenSSF/OSV malware advisory MAL-2026-6303 blocks this version. Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a posti...

OpenSSF/OSV malware advisory MAL-2026-6416 blocks this version. Pattern matches fired on index.js for the co-occurrence of child_process require, HTTP GET calls, and env-related keywords...

OpenSSF/OSV malware advisory MAL-2026-6282 blocks this version. index.js imports child_process and calls execSync with bash and zsh (lines 301 and 317). Without further context, it is unc...

OpenSSF/OSV malware advisory MAL-2026-6334 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shells (index.js line 1, 301, 317). Without traced ex...

OpenSSF/OSV malware advisory MAL-2026-6284 blocks this version. index.js imports child_process and contains execSync calls invoking bash and zsh (around lines 301 and 317). Without traced...

OpenSSF/OSV malware advisory MAL-2026-6332 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5880 blocks this version. The package ships a bundled file at dist/node/payload.js containing several POST call sites (around lines 14592, 14621, 148...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

OpenSSF/OSV malware advisory MAL-2026-5827 blocks this version. index-ulid impersonates the legitimate `ulid`/`ulidx` ULID generator (reuses ulid's description and links its homepage to g...

OpenSSF/OSV malware advisory MAL-2026-5851 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5358 blocks this version. Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.j...

OpenSSF/OSV malware advisory MAL-2026-5355 blocks this version. Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.j...

OpenSSF/OSV malware advisory MAL-2026-5352 blocks this version. **Note:** *This report is updated by a verification record*

OpenSSF/OSV malware advisory MAL-2026-5873 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-6335 blocks this version. package.json declares `postinstall: node test.js`, but test.js is not present in the tarball — installation fails with MODU...