npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6581 blocks this version. scripts/postinstall.js executes automatically on `npm install` and performs a bulk harvest of installer-side identity and c...

OpenSSF/OSV malware advisory MAL-2026-6911 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-6910 blocks this version. The package declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js requires `os`,...

OpenSSF/OSV malware advisory MAL-2026-6848 blocks this version. Package advertises itself as a log formatter but exposes an undocumented `threadContent` option on `createLogger()` that is...

OpenSSF/OSV malware advisory MAL-2026-6499 blocks this version. helpers.js defines a createLog() helper that base64-decodes a constant HASH_KEY to https://www.jsonkeeper.com/b/XVHGD (an a...

OpenSSF/OSV malware advisory MAL-2026-6848 blocks this version. Package advertises itself as a log formatter but exposes an undocumented `threadContent` option on `createLogger()` that is...

OpenSSF/OSV malware advisory MAL-2026-6896 blocks this version. Package name resembles common ESLint/TypeScript tooling and the main entry index.js contains base64 decoding via Buffer.fro...

OpenSSF/OSV malware advisory MAL-2026-6834 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6476 blocks this version. On `require('typedecode')` / `import 'typedecode'`, the bundled `dist/index.cjs` and `dist/index.js` execute an obfuscated...

OpenSSF/OSV malware advisory MAL-2026-6476 blocks this version. On `require('typedecode')` / `import 'typedecode'`, the bundled `dist/index.cjs` and `dist/index.js` execute an obfuscated...

OpenSSF/OSV malware advisory MAL-2026-6875 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-6899 blocks this version. The package's main entry point src/index.js contains heavily obfuscated JavaScript at line 138 using a classic string-array...

OpenSSF/OSV malware advisory MAL-2026-6899 blocks this version. The package's main entry point src/index.js contains heavily obfuscated JavaScript at line 138 using a classic string-array...

OpenSSF/OSV malware advisory MAL-2026-6900 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6875 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-5578 blocks this version. On `npm install`, the package runs a postinstall hook (`node -e "require('./loader.js')"`) that spawns a detached child pro...

OpenSSF/OSV malware advisory MAL-2026-6906 blocks this version. The package's index.js is heavily obfuscated (string-array shift/rotate pattern with hex-encoded indices and a `while(!![])...