npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...

OpenSSF/OSV malware advisory MAL-2026-6473 blocks this version. Package presents itself as a minimal React color-picker but ships a postinstall hook (`"postinstall": "node setup.js"`) tha...

OpenSSF/OSV malware advisory MAL-2026-6473 blocks this version. Package presents itself as a minimal React color-picker but ships a postinstall hook (`"postinstall": "node setup.js"`) tha...

OpenSSF/OSV malware advisory MAL-2026-6369 blocks this version. Package impersonates the well-known eth-gas-reporter / hardhat-gas-reporter packages: README is titled 'eth-test-log', copi...

OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...

OpenSSF/OSV malware advisory MAL-2026-6406 blocks this version. Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveill...

OpenSSF/OSV malware advisory MAL-2026-6374 blocks this version. Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_m...

OpenSSF/OSV malware advisory MAL-2026-6374 blocks this version. Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_m...

OpenSSF/OSV malware advisory MAL-2026-6273 blocks this version. The package is published under a name suggesting a Pino logger integration for Zod, but the tarball contents do not match t...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...

OpenSSF/OSV malware advisory MAL-2026-6299 blocks this version. The package's postinstall hook (install-hook.js, invoked via package.json scripts.postinstall) fetches an opaque binary 'pa...