npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6335 blocks this version. package.json declares `postinstall: node test.js`, but test.js is not present in the tarball — installation fails with MODU...

OpenSSF/OSV malware advisory MAL-2026-6119 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shells (lines 315 and 331). Without traced reachabili...

OpenSSF/OSV malware advisory MAL-2026-6112 blocks this version. The package declares a postinstall lifecycle hook ("postinstall": "node run.js" in package.json) that executes run.js autom...

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6543 blocks this version. package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's m...

OpenSSF/OSV malware advisory MAL-2026-6062 blocks this version. The package ships several files whose names and contents suggest a non-trivial install-time and runtime footprint: a postin...

OpenSSF/OSV malware advisory MAL-2026-6062 blocks this version. The package ships several files whose names and contents suggest a non-trivial install-time and runtime footprint: a postin...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...

OpenSSF/OSV malware advisory MAL-2026-5691 blocks this version. The package ships a postinstall.js that imports child_process and references HTTP GET and hostname operations. Without trac...

OpenSSF/OSV malware advisory MAL-2026-5687 blocks this version. The package's postinstall.js imports child_process and references HTTP GET calls and hostname lookups during the install li...

OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...

OpenSSF/OSV malware advisory MAL-2026-6543 blocks this version. package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's m...

OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...

OpenSSF/OSV malware advisory MAL-2026-5846 blocks this version. Package name 'prettier_v2' closely resembles the widely-used 'prettier' formatter package, raising typosquat concerns. The...

OpenSSF/OSV malware advisory MAL-2026-5627 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5845 blocks this version. Package name 'prettier_v1' closely resembles the widely-used 'prettier' formatter package, a classic typosquat naming patte...

OpenSSF/OSV malware advisory MAL-2026-5842 blocks this version. lib/mirror.js line 13 contains a Buffer.from(..., "base64").toString("utf8") pattern. This decoding primitive is common in...