npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-7013 blocks this version. The package's declared postinstall script reads the installer's OS username via os.userInfo().username and the machine host...

OpenSSF/OSV malware advisory MAL-2026-7009 blocks this version. The package impersonates the `pino` logger (README badges, `module.exports.pino = middleware`) under a one-character-omissi...

OpenSSF/OSV malware advisory MAL-2026-7012 blocks this version. The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatti...

OpenSSF/OSV malware advisory MAL-2026-7011 blocks this version. The package's preinstall hook ("node index.js") runs automatically on `npm install` and executes an exfiltration payload. i...

OpenSSF/OSV malware advisory MAL-2026-7014 blocks this version. The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evalu...

OpenSSF/OSV malware advisory MAL-2026-7010 blocks this version. crypto-promiser@1.0.1 is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-6933 blocks this version. Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration,...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-6968 blocks this version. The package's postinstall hook auto-executes index.js on npm install. The script collects the installer's OS username (os.u...

OpenSSF/OSV malware advisory MAL-2026-6936 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-6967 blocks this version. The package declares a postinstall hook that runs index.js on npm install. index.js collects the installer's OS username (o...

OpenSSF/OSV malware advisory MAL-2026-6941 blocks this version. Package name 'shopify-internel' is a one-character misspelling of 'shopify-internal' and appears to squat on the Shopify na...

OpenSSF/OSV malware advisory MAL-2026-6679 blocks this version. Package agent-starter-pack@0.0.1 was scanned with no a static rule matches and no behavioral findings. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-6991 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host and user identity data...

OpenSSF/OSV malware advisory MAL-2026-6988 blocks this version. `@vite-tab/tab` republishes Vite's codebase under a different name while impersonating the upstream project: `package.json`...

OpenSSF/OSV malware advisory MAL-2026-7002 blocks this version. The package's postinstall hook (`node index.js`) runs automatically on `npm install` and collects the installer's OS userna...

OpenSSF/OSV malware advisory MAL-2026-7004 blocks this version. On `npm install`, the package's postinstall hook executes index.js, which collects the installer's OS username (os.userInfo...

OpenSSF/OSV malware advisory MAL-2026-7001 blocks this version. The package's main entry (index.js) collects installer identity data — os.userInfo().username, process.env.INIT_CWD || proc...

OpenSSF/OSV malware advisory MAL-2026-6989 blocks this version. ag-charts-test@99.9.1 is a hollow package (empty index.js, no scripts, no documented functionality) whose sole effect on in...