npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5395 blocks this version. The package advertises itself as a simple SQL helper but its main entry index.js is heavily obfuscated (obfuscator.io strin...

OpenSSF/OSV malware advisory MAL-2026-10059 blocks this version. Package name and metadata impersonate the widely-used `cookie-parser` middleware: README, API surface, and `package.json`...

OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...

OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...

OpenSSF/OSV malware advisory MAL-2026-6695 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `ts-bn-proto` embeds an infostea...

OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...

OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...

OpenSSF/OSV malware advisory MAL-2026-6063 blocks this version. Pattern matches fired on minified files extended/b+tree.min.js and extended/bulkLoad.min.d.js based on keyword co-occurrenc...

OpenSSF/OSV malware advisory MAL-2026-6063 blocks this version. Pattern matches fired on minified files extended/b+tree.min.js and extended/bulkLoad.min.d.js based on keyword co-occurrenc...

OpenSSF/OSV malware advisory MAL-2026-6205 blocks this version. The package is published as `ts-esys` but its package.json author, repository URL, funding metadata, and README are copied...

OpenSSF/OSV malware advisory MAL-2026-5855 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5361 blocks this version. **Note:** *This report is updated by a verification record*

OpenSSF/OSV malware advisory MAL-2026-5308 blocks this version. The package is published as 'nodemon-copack' but its package.json wholesale impersonates the legitimate nodemon project: ho...

OpenSSF/OSV malware advisory MAL-2026-5165 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5164 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5165 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5164 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-7024 blocks this version. package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js...

OpenSSF/OSV malware advisory MAL-2026-7024 blocks this version. package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js...

OpenSSF/OSV malware advisory MAL-2026-7024 blocks this version. package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js...