npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...

OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...

OpenSSF/OSV malware advisory MAL-2026-5882 blocks this version. Package is published as `redis-type-os` but all in-package references (README, docs/, CHANGELOG, repository field, author e...

OpenSSF/OSV malware advisory MAL-2026-5881 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-7024 blocks this version. package.json declares a `prepare` lifecycle script (`node index.js || true`) that auto-executes on `npm install`. index.js...

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-3288 blocks this version. Malicious npm package published by user `shetty123` as part of a Telegram account hijacking framework targeting Indian Tele...

OpenSSF/OSV malware advisory MAL-2026-5218 blocks this version. autotel-devtools ships bundled CommonJS and ESM artifacts (dist/cli.cjs, dist/cli.js, dist/index.cjs, dist/index.js, dist/s...

OpenSSF/OSV malware advisory MAL-2026-5308 blocks this version. The package is published as 'nodemon-copack' but its package.json wholesale impersonates the legitimate nodemon project: ho...

OpenSSF/OSV malware advisory MAL-2026-6361 blocks this version. Package occupies the unscoped npm name `vscode-test-web`, a likely-misreference target for the legitimate `@vscode/test-web...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-6727 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5163 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5879 blocks this version. `ioredis-os` appends `-os` to the widely-used `ioredis` package name and ships what appears to be a verbatim fork of ioredi...

OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...

OpenSSF/OSV malware advisory MAL-2026-6113 blocks this version. intquery@1.1.5 is published under the name 'intquery' by 'Stagnation Lab', but its README is a verbatim copy of the unrelat...

OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...

OpenSSF/OSV malware advisory MAL-2026-5343 blocks this version. `progerss-cli` is a typosquat of the popular `cli-progress` package that ships an obfuscated payload executed automatically...

OpenSSF/OSV malware advisory MAL-2026-5342 blocks this version. `kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload exe...

OpenSSF/OSV malware advisory MAL-2026-5883 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code