npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-3609 blocks this version. forge-jsxy is a malicious npm package part of the same campaign as forge-jsx. It typosquats the name by appending a 'y' and...

OpenSSF/OSV malware advisory MAL-2026-6508 blocks this version. tw-style-utils@0.7.0 was scanned and produced no findings indicative of supply-chain attack behavior. No install-time lifec...

OpenSSF/OSV malware advisory MAL-2026-6508 blocks this version. tw-style-utils@0.7.0 was scanned and produced no findings indicative of supply-chain attack behavior. No install-time lifec...

OpenSSF/OSV malware advisory MAL-2026-4799 blocks this version. Package name `pdf-lib-enhanced` mimics the widely-used `pdf-lib` library and ships a verbatim copy of upstream's README. `p...

OpenSSF/OSV malware advisory MAL-2026-7013 blocks this version. The package's declared postinstall script reads the installer's OS username via os.userInfo().username and the machine host...

OpenSSF/OSV malware advisory MAL-2026-6948 blocks this version. The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan....

OpenSSF/OSV malware advisory MAL-2026-7016 blocks this version. On `npm install`, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-producti...

OpenSSF/OSV malware advisory MAL-2026-6991 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host and user identity data...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-7013 blocks this version. The package's declared postinstall script reads the installer's OS username via os.userInfo().username and the machine host...

OpenSSF/OSV malware advisory MAL-2026-7009 blocks this version. The package impersonates the `pino` logger (README badges, `module.exports.pino = middleware`) under a one-character-omissi...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-7011 blocks this version. The package's preinstall hook ("node index.js") runs automatically on `npm install` and executes an exfiltration payload. i...

OpenSSF/OSV malware advisory MAL-2026-7014 blocks this version. The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evalu...

OpenSSF/OSV malware advisory MAL-2026-7010 blocks this version. crypto-promiser@1.0.1 is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-6933 blocks this version. Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration,...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-6968 blocks this version. The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username (os.u...

OpenSSF/OSV malware advisory MAL-2026-6936 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...