npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10097 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...

OpenSSF/OSV malware advisory MAL-2026-7031 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10021 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6741 blocks this version. index.js unconditionally requires `@sql-trigger/nodesql` at the top of the main file (`var ins = require('@sql-trigger/node...

OpenSSF/OSV malware advisory MAL-2026-7028 blocks this version. Package ships a 5.7MB prebuilt darwin-arm64 Mach-O at vendor/clavuepro-darwin-arm64 with no source tree, no hash/signature...

OpenSSF/OSV malware advisory MAL-2026-5628 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-7024 blocks this version. package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js...

OpenSSF/OSV malware advisory MAL-2026-7024 blocks this version. package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js...

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6592 blocks this version. The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import...

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...

OpenSSF/OSV malware advisory MAL-2026-6575 blocks this version. Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers (Chrome, Brave, E...

OpenSSF/OSV malware advisory MAL-2026-6517 blocks this version. All published JavaScript in dist/ (index.js, client.js, server.js, react.js, and sibling chunks) is heavily obfuscated usin...

OpenSSF/OSV malware advisory MAL-2026-6507 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6505 blocks this version. Package advertises itself as a pino+zod logging helper but ships content that does not match that purpose: a `dist/discordR...

OpenSSF/OSV malware advisory MAL-2026-6505 blocks this version. Package advertises itself as a pino+zod logging helper but ships content that does not match that purpose: a `dist/discordR...

OpenSSF/OSV malware advisory MAL-2026-6271 blocks this version. On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host (node22.lunes.host:3258), authenticates with a 5-minute...

OpenSSF/OSV malware advisory MAL-2026-6279 blocks this version. forge-jsx4 is a remote access trojan (RAT) published to the public npm registry by the account rafael_silva (rafael_silva@o...