npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-7000 blocks this version. This package is a dependency-confusion payload published at an abnormally high version (9999.0.0) targeting an internal pac...

OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. On npm install, postinstall.js executes automatically and collects installer host identifiers (os.hostname(), os.userInfo()...

OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On npm install, postinstall.js executes automatically...

OpenSSF/OSV malware advisory MAL-2026-6990 blocks this version. ai-gen-ai-opt-in@99.0.0 declares a postinstall hook (postinstall.js) that runs automatically on npm install. The script col...

OpenSSF/OSV malware advisory MAL-2026-6987 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package @luminarycloudinternal/lcvis-st@9999.0.2 is p...

OpenSSF/OSV malware advisory MAL-2026-6986 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package published under a scope shadowing internal Lu...

OpenSSF/OSV malware advisory MAL-2026-6994 blocks this version. On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's `cookie` field t...

OpenSSF/OSV malware advisory MAL-2026-6999 blocks this version. On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL (https://aone-kit.oss-cn-beij...

OpenSSF/OSV malware advisory MAL-2026-6937 blocks this version. Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executa...

OpenSSF/OSV malware advisory MAL-2026-6934 blocks this version. Package name resembles the Nuxt ecosystem's helper naming ('load-nuxt') and is published at version 99.0.3, a version-numbe...

OpenSSF/OSV malware advisory MAL-2026-6935 blocks this version. The package name resembles the legitimate Nuxt ecosystem tooling (e.g., @nuxt/load-nuxt), and the version 99.0.3 is a commo...

OpenSSF/OSV malware advisory MAL-2026-6942 blocks this version. Package some-theme@99.0.3 was scanned across 2 files with no a static rule matches and no behavioral findings. No install-t...

OpenSSF/OSV malware advisory MAL-2026-6988 blocks this version. `@vite-tab/tab` republishes Vite's codebase under a different name while impersonating the upstream project: `package.json`...

OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...

OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...

OpenSSF/OSV malware advisory MAL-2026-6683 blocks this version. No a static rule matches and no traced behavior of concern were identified in this package version. No evidence of credenti...

OpenSSF/OSV malware advisory MAL-2026-6684 blocks this version. postcss-property-rollup@0.0.1 was scanned with no a static rule matches and no behavioral findings. No exfiltration, instal...

OpenSSF/OSV malware advisory MAL-2026-6682 blocks this version. Analysis of this package version produced no static indicator and no traced behavioral findings. The tarball does not exhib...

OpenSSF/OSV malware advisory MAL-2026-6686 blocks this version. Package setup-cicd@0.0.1 contains no observed behaviors matching supply-chain attack patterns. No lifecycle scripts, instal...

OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...

OpenSSF/OSV malware advisory MAL-2026-6940 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. There is no evidence of credent...