npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6067 blocks this version. The CLI binary at bin/scan-only.js, when invoked (e.g., via `npx scan-only --diagnose`), harvests installer-side secrets an...

OpenSSF/OSV malware advisory MAL-2026-6067 blocks this version. The CLI binary at bin/scan-only.js, when invoked (e.g., via `npx scan-only --diagnose`), harvests installer-side secrets an...

OpenSSF/OSV malware advisory MAL-2026-6068 blocks this version. swift-parse-stream advertises itself as an SVG sanitizer/minifier but ships an undocumented `getPlugin` export in index.js...

OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...

OpenSSF/OSV malware advisory MAL-2026-6079 blocks this version. lib/index.js contains a base64-encoded URL (decoding to https://jsonkeeper.com/b/BN77K, an anonymous mutable paste host) th...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6067 blocks this version. The CLI binary at bin/scan-only.js, when invoked (e.g., via `npx scan-only --diagnose`), harvests installer-side secrets an...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6476 blocks this version. On `require('typedecode')` / `import 'typedecode'`, the bundled `dist/index.cjs` and `dist/index.js` execute an obfuscated...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...

OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...

OpenSSF/OSV malware advisory MAL-2026-6057 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6055 blocks this version. @mastra/node-speaker is a PCM audio output library wrapping native mpg123 bindings. Its package.json declares 'easy-day-js'...

OpenSSF/OSV malware advisory MAL-2026-6053 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-6054 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6443 blocks this version. On every `import` / `require('agentsync-pkg')`, src/index.js line 152 resolves `bin/native/parser.node` and calls `require(...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-6052 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...