npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5885 blocks this version. On `npm install`, the declared postinstall hook runs `node main.js`, which decodes an obfuscated URL (stored as `DEV_API_KE...

OpenSSF/OSV malware advisory MAL-2026-5885 blocks this version. On `npm install`, the declared postinstall hook runs `node main.js`, which decodes an obfuscated URL (stored as `DEV_API_KE...

OpenSSF/OSV malware advisory MAL-2026-5936 blocks this version. vite-config-field@1.1.0 impersonates the legitimate vite-plugin-pwa package (README copies its banner/badges, funding field...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5825 blocks this version. The package's main file (index.js) is heavily obfuscated using obfuscator.io-style string-array rotation, base64 fragments,...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-5935 blocks this version. The published entrypoints dist/index.cjs and dist/runtime.cjs contain an injected IIFE that assigns `global.r = require` an...

OpenSSF/OSV malware advisory MAL-2026-5750 blocks this version. The package advertises itself as an email-confirmation utility, but index.js contains only no-op stubs that console.log dem...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-5798 blocks this version. On `npm install`, scripts/postinstall.js connects to a hardcoded attacker IP (http://213.218.160.189:8080, fallback:80), se...

OpenSSF/OSV malware advisory MAL-2026-5707 blocks this version. ttspc-server-sample@99.9.0 declares `postinstall: node index.js` in package.json, so on `npm install` it automatically exec...

OpenSSF/OSV malware advisory MAL-2026-5707 blocks this version. ttspc-server-sample@99.9.0 declares `postinstall: node index.js` in package.json, so on `npm install` it automatically exec...

OpenSSF/OSV malware advisory MAL-2026-5798 blocks this version. On `npm install`, scripts/postinstall.js connects to a hardcoded attacker IP (http://213.218.160.189:8080, fallback:80), se...

OpenSSF/OSV malware advisory MAL-2026-5798 blocks this version. On `npm install`, scripts/postinstall.js connects to a hardcoded attacker IP (http://213.218.160.189:8080, fallback:80), se...

OpenSSF/OSV malware advisory MAL-2026-5930 blocks this version. package.json declares `"postinstall": "node index.js"`, and index.js is a heavily obfuscated single-file script (RC4+base64...