npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...

OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...

OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...

OpenSSF/OSV malware advisory MAL-2026-6535 blocks this version. The package ships a 2.9 MB Windows PE32+ executable at bin/native/parser.node (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b...

OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...

OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...

OpenSSF/OSV malware advisory MAL-2026-6320 blocks this version. ts-escrow@0.1.0 is a verbatim copy of the big.js library (README, repository URL, author, version banner, and description a...

OpenSSF/OSV malware advisory MAL-2026-6274 blocks this version. The package advertises itself as a Web3 fee utility but its main export is a dropper. index.js line 140 base64-decodes a pl...

OpenSSF/OSV malware advisory MAL-2023-1111 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs automatically on npm install. index.js re...

OpenSSF/OSV malware advisory MAL-2026-6485 blocks this version. starship-timeline@1.0.1 ships no real functionality. Its package.json declares a preinstall hook (`"preinstall": "node inde...

OpenSSF/OSV malware advisory MAL-2026-6367 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js collects insta...

OpenSSF/OSV malware advisory MAL-2026-6379 blocks this version. On `npm install`, the package's preinstall hook (`package.json` declares `"preinstall": "node index.js"`) executes index.js...

OpenSSF/OSV malware advisory MAL-2026-6256 blocks this version. @withgoogle/stitch-sdk is a scope-squatting package on npm that impersonates Google's Stitch AI design tool SDK. The attack...

OpenSSF/OSV malware advisory MAL-2026-6341 blocks this version. On require(), index.js invokes _initMsgCache() at module top level. The function derives an AES-256-CBC key, IV, and cipher...

OpenSSF/OSV malware advisory MAL-2026-6345 blocks this version. Package name `thurdweb` is a one-character substitution of the popular web3 SDK `thirdweb`, but the shipped source is a cop...

OpenSSF/OSV malware advisory MAL-2026-6343 blocks this version. Package is published as `thidweb` but its README, source comments, repo URL, and author metadata all identify it as big.js...

OpenSSF/OSV malware advisory MAL-2026-6342 blocks this version. The package's name 'therdweb' is a one-character variation of the popular 'thirdweb' SDK, while its contents (README, sourc...

OpenSSF/OSV malware advisory MAL-2026-6344 blocks this version. Package name impersonates the well-known 'thirdweb' brand but ships a verbatim copy of MikeMcl's big.js arithmetic library...

OpenSSF/OSV malware advisory MAL-2026-6340 blocks this version. Package 'rainbownkit' is a single-character typosquat of the popular Web3 library 'rainbowkit'. The shipped source, README,...

OpenSSF/OSV malware advisory MAL-2026-6339 blocks this version. The package publishes as `rainbokit` but ships a verbatim copy of the legitimate `big.js` library (matching author, reposit...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...