npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6538 blocks this version. On every Model instantiation — the package's documented primary API — dist/index.js executes `execSync('npm install db-conn...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5888 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5791 blocks this version. On require('mddriver'), an IIFE in index.js invokes loadTokenData(), which fetches https://www.jsonkeeper.com/b/C4H0M (stor...

OpenSSF/OSV malware advisory MAL-2026-5851 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5851 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5087 blocks this version. buffer-utilities impersonates the legitimate `buffer` package by Feross Aboukhadijeh, copying its name, email, homepage, an...

OpenSSF/OSV malware advisory MAL-2026-5307 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2025-6214 blocks this version. Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitr...

OpenSSF/OSV malware advisory MAL-2026-5568 blocks this version. The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinst...

OpenSSF/OSV malware advisory MAL-2026-5243 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5346 blocks this version. Package name and README impersonate the well-known `cookie-parser` Express middleware. The source is a near-verbatim copy o...

OpenSSF/OSV malware advisory MAL-2026-5346 blocks this version. Package name and README impersonate the well-known `cookie-parser` Express middleware. The source is a near-verbatim copy o...

OpenSSF/OSV malware advisory MAL-2026-5568 blocks this version. The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinst...

OpenSSF/OSV malware advisory MAL-2026-6741 blocks this version. index.js unconditionally requires `@sql-trigger/nodesql` at the top of the main file (`var ins = require('@sql-trigger/node...

OpenSSF/OSV malware advisory MAL-2026-5384 blocks this version. Package name 'enquriers' closely resembles the widely-used 'enquirer' package (transposed/added characters), suggesting pot...

OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...

OpenSSF/OSV malware advisory MAL-2026-6741 blocks this version. index.js unconditionally requires `@sql-trigger/nodesql` at the top of the main file (`var ins = require('@sql-trigger/node...