npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6875 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-6899 blocks this version. The package's main entry point src/index.js contains heavily obfuscated JavaScript at line 138 using a classic string-array...

OpenSSF/OSV malware advisory MAL-2026-6899 blocks this version. The package's main entry point src/index.js contains heavily obfuscated JavaScript at line 138 using a classic string-array...

OpenSSF/OSV malware advisory MAL-2026-6900 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6875 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-6874 blocks this version. The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires...

OpenSSF/OSV malware advisory MAL-2026-5578 blocks this version. On `npm install`, the package runs a postinstall hook (`node -e "require('./loader.js')"`) that spawns a detached child pro...

OpenSSF/OSV malware advisory MAL-2026-6906 blocks this version. The package's index.js is heavily obfuscated (string-array shift/rotate pattern with hex-encoded indices and a `while(!![])...

OpenSSF/OSV malware advisory MAL-2026-6885 blocks this version. No suspicious behaviors were observed in this package version. There are no lifecycle scripts performing remote fetches, no...

OpenSSF/OSV malware advisory MAL-2026-6903 blocks this version. No suspicious behaviors were observed in this package version. There are no lifecycle scripts fetching or executing remote...

OpenSSF/OSV malware advisory MAL-2026-6884 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5577 blocks this version. Requiring web-pool triggers middleware() to spawn a detached `node lib/initializeCaller.js`. That script base64-decodes a h...

OpenSSF/OSV malware advisory MAL-2026-6855 blocks this version. Package impersonates the widely-used `bn.js` crypto library: README, repository URL, logo, and source files are copied verb...

OpenSSF/OSV malware advisory MAL-2026-4640 blocks this version. Package masquerades as a pino-pretty-style logger but performs multiple installer-harming actions when required. On import,...

OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...

OpenSSF/OSV malware advisory MAL-2026-3775 blocks this version. Package name 'tsliverhome' impersonates the widely-used 'tslib' package (~300M weekly downloads). The shipped README.md is...

OpenSSF/OSV malware advisory MAL-2026-6904 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...