npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-7314 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-7030 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6769 blocks this version. The @marketfront/captchaservice package is part of a 25-package malicious campaign batch-published to the @marketfront npm...

OpenSSF/OSV malware advisory MAL-2026-5371 blocks this version. @doaction/example@99.99.99 is a scoped npm package whose package.json self-describes as 'Example package with Datadog envir...

OpenSSF/OSV malware advisory MAL-2026-5372 blocks this version. @doaction/examples@99.99.99 declares `preinstall: node scripts/postinstall.js` in package.json, which requires `@doaction/s...

OpenSSF/OSV malware advisory MAL-2026-5372 blocks this version. @doaction/examples@99.99.99 declares `preinstall: node scripts/postinstall.js` in package.json, which requires `@doaction/s...

OpenSSF/OSV malware advisory MAL-2026-10094 blocks this version. package.json declares a postinstall hook (`node setup.js`) that fires automatically on `npm install`. setup.js selects a p...

OpenSSF/OSV malware advisory MAL-2026-10094 blocks this version. package.json declares a postinstall hook (`node setup.js`) that fires automatically on `npm install`. setup.js selects a p...

OpenSSF/OSV malware advisory MAL-2026-10092 blocks this version. Package `vite-pwa-config` impersonates the popular `vite-plugin-pwa` (antfu) — the README instructs users to import `confi...

OpenSSF/OSV malware advisory MAL-2026-10019 blocks this version. package.json declares postinstall=`node index.js`, which runs automatically on `npm install`. index.js collects host ident...

OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...

OpenSSF/OSV malware advisory MAL-2026-10073 blocks this version. The package presents itself as a Tailwind CSS animation plugin and reproduces the legitimate tailwindcss-animate source (i...

OpenSSF/OSV malware advisory MAL-2026-10073 blocks this version. The package presents itself as a Tailwind CSS animation plugin and reproduces the legitimate tailwindcss-animate source (i...

OpenSSF/OSV malware advisory MAL-2026-6797 blocks this version. On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GE...

OpenSSF/OSV malware advisory MAL-2026-6797 blocks this version. On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GE...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-10082 blocks this version. The package presents itself as a pino-compatible logger (lib/ directory mirrors pino's internal file layout — proto.js, le...

OpenSSF/OSV malware advisory MAL-2026-6947 blocks this version. On `npm install`, package.json's postinstall executes dist/setup.js and dist/postinstall.js. The scripts read installer-sid...

OpenSSF/OSV malware advisory MAL-2026-10088 blocks this version. `lovable-tager` is a single-character-deletion typosquat of the legitimate Vite plugin `lovable-tagger`. The ESM entry `di...

OpenSSF/OSV malware advisory MAL-2026-10088 blocks this version. `lovable-tager` is a single-character-deletion typosquat of the legitimate Vite plugin `lovable-tagger`. The ESM entry `di...