npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-7002 blocks this version. The package's postinstall hook (`node index.js`) runs automatically on `npm install` and collects the installer's OS userna...

OpenSSF/OSV malware advisory MAL-2026-7004 blocks this version. On `npm install`, the package's postinstall hook executes index.js, which collects the installer's OS username (os.userInfo...

OpenSSF/OSV malware advisory MAL-2026-7001 blocks this version. The package's main entry (index.js) collects installer identity data — os.userInfo().username, process.env.INIT_CWD || proc...

OpenSSF/OSV malware advisory MAL-2026-6989 blocks this version. ag-charts-test@99.9.1 is a hollow package (empty index.js, no scripts, no documented functionality) whose sole effect on in...

OpenSSF/OSV malware advisory MAL-2026-6992 blocks this version. Package name `babel-eslint-parser-legacy` is a one-suffix confusion against the legitimate `babel-eslint-parser`. The packa...

OpenSSF/OSV malware advisory MAL-2026-6998 blocks this version. Package `higherlogic-ocfe@99.9.1` is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published...

OpenSSF/OSV malware advisory MAL-2026-6993 blocks this version. Package published at version 9999.0.0 under the name `bytefaas-sdk`, the canonical dependency-confusion shape used to shado...

OpenSSF/OSV malware advisory MAL-2026-6997 blocks this version. goofy-sdk@9999.0.0 is a dependency-confusion squat: the version is inflated to 9999.0.0 to shadow an internal package of th...

OpenSSF/OSV malware advisory MAL-2026-7000 blocks this version. This package is a dependency-confusion payload published at an abnormally high version (9999.0.0) targeting an internal pac...

OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. On npm install, postinstall.js executes automatically and collects installer host identifiers (os.hostname(), os.userInfo()...

OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On npm install, postinstall.js executes automatically...

OpenSSF/OSV malware advisory MAL-2026-6990 blocks this version. ai-gen-ai-opt-in@99.0.0 declares a postinstall hook (postinstall.js) that runs automatically on npm install. The script col...

OpenSSF/OSV malware advisory MAL-2026-6987 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package @luminarycloudinternal/lcvis-st@9999.0.2 is p...

OpenSSF/OSV malware advisory MAL-2026-6986 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package published under a scope shadowing internal Lu...

OpenSSF/OSV malware advisory MAL-2026-6994 blocks this version. On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's `cookie` field t...

OpenSSF/OSV malware advisory MAL-2026-6999 blocks this version. On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL (https://aone-kit.oss-cn-beij...

OpenSSF/OSV malware advisory MAL-2026-6937 blocks this version. Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executa...

OpenSSF/OSV malware advisory MAL-2026-6934 blocks this version. Package name resembles the Nuxt ecosystem's helper naming ('load-nuxt') and is published at version 99.0.3, a version-numbe...

OpenSSF/OSV malware advisory MAL-2026-6935 blocks this version. The package name resembles the legitimate Nuxt ecosystem tooling (e.g., @nuxt/load-nuxt), and the version 99.0.3 is a commo...

OpenSSF/OSV malware advisory MAL-2026-6942 blocks this version. Package some-theme@99.0.3 was scanned across 2 files with no a static rule matches and no behavioral findings. No install-t...