npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...

OpenSSF/OSV malware advisory MAL-2026-6555 blocks this version. The unscoped npm package `livekit-agents` advertises itself in README as the official LiveKit Agents SDK and links to livek...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-6908 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6952 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6952 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6574 blocks this version. yandex-geobase@3.9.0 squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTT...

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6710 blocks this version. The package's postinstall script (`node lib/utils/index.js`) spawns a detached, stdio-suppressed Node child process that ru...

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...