npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5707 blocks this version. ttspc-server-sample@99.9.0 declares `postinstall: node index.js` in package.json, so on `npm install` it automatically exec...

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...

OpenSSF/OSV malware advisory MAL-2026-5678 blocks this version. index.js implements a multi-step attack against an internal npm registry. On invocation of the exported command(), it: (1)...

OpenSSF/OSV malware advisory MAL-2026-5677 blocks this version. package.json declares `"postinstall": "node main.js"`, so installation of worker-build@9.0.1 unconditionally executes main....

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

OpenSSF/OSV malware advisory MAL-2026-5677 blocks this version. package.json declares `"postinstall": "node main.js"`, so installation of worker-build@9.0.1 unconditionally executes main....

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-5882 blocks this version. Package is published as `redis-type-os` but all in-package references (README, docs/, CHANGELOG, repository field, author e...

OpenSSF/OSV malware advisory MAL-2026-5845 blocks this version. Package name 'prettier_v1' closely resembles the widely-used 'prettier' formatter package, a classic typosquat naming patte...

OpenSSF/OSV malware advisory MAL-2026-5882 blocks this version. Package is published as `redis-type-os` but all in-package references (README, docs/, CHANGELOG, repository field, author e...

OpenSSF/OSV malware advisory MAL-2026-5369 blocks this version. package.json declares "preinstall": "node scripts/postinstall.js", which require()s '@doaction/shared/bin/postinstall.js'....

OpenSSF/OSV malware advisory MAL-2026-5380 blocks this version. `@doaction/sudo-prompt` shares the name of the widely-used unscoped `sudo-prompt` package but contains none of its privileg...

OpenSSF/OSV malware advisory MAL-2026-5369 blocks this version. package.json declares "preinstall": "node scripts/postinstall.js", which require()s '@doaction/shared/bin/postinstall.js'....

OpenSSF/OSV malware advisory MAL-2026-5635 blocks this version. Package name `routing-controls` is a one-edit variant of the popular `routing-controllers` package (~1M weekly downloads),...

OpenSSF/OSV malware advisory MAL-2026-6387 blocks this version. Package name 'multer-express' is similar to the widely used 'multer' middleware for Express. No malicious code patterns, in...

OpenSSF/OSV malware advisory MAL-2026-6592 blocks this version. The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import...

OpenSSF/OSV malware advisory MAL-2026-5666 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5666 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5666 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code