npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...

OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...

OpenSSF/OSV malware advisory MAL-2026-6457 blocks this version. The package's main entry `index.js` is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfusc...

OpenSSF/OSV malware advisory MAL-2026-6084 blocks this version. @array-util/nodepull@1.1.1 ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silenc...

OpenSSF/OSV malware advisory MAL-2026-6457 blocks this version. The package's main entry `index.js` is the only file of substance and is wrapped in obfuscator.io string-array + RC4 obfusc...

OpenSSF/OSV malware advisory MAL-2026-5491 blocks this version. The package ships scripts/script.js containing heavy obfuscation patterns (string-array shift rotation, hex-encoded numeric...

OpenSSF/OSV malware advisory MAL-2026-6183 blocks this version. preinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hos...

OpenSSF/OSV malware advisory MAL-2026-5087 blocks this version. buffer-utilities impersonates the legitimate `buffer` package by Feross Aboukhadijeh, copying its name, email, homepage, an...

OpenSSF/OSV malware advisory MAL-2026-2929 blocks this version. On require(), path.js runs an IIFE that calls a loader which fetches a base64-hidden URL (https://www.jsonkeeper.com/b/XTTB...

OpenSSF/OSV malware advisory MAL-2026-4592 blocks this version. On require()/import of jsontoken-extend, sign.js executes a top-level IIFE that base64-decodes a hardcoded string to https:...

OpenSSF/OSV malware advisory MAL-2026-6316 blocks this version. Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl...

OpenSSF/OSV malware advisory MAL-2026-6195 blocks this version. index.js imports child_process and contains a hardcoded outbound POST to https://tg-wallet-manager.vercel.app, with additio...

OpenSSF/OSV malware advisory MAL-2026-6068 blocks this version. swift-parse-stream advertises itself as an SVG sanitizer/minifier but ships an undocumented `getPlugin` export in index.js...

OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...

OpenSSF/OSV malware advisory MAL-2026-6066 blocks this version. The package is advertised as an SVG sanitizer but exposes an undocumented getPlugin() export whose returned function fetche...

OpenSSF/OSV malware advisory MAL-2026-4621 blocks this version. nolimit-x ships an entirely obfuscator.io-packed runtime (45 files under.ad/, including the x0.js entrypoint) with no reada...

OpenSSF/OSV malware advisory MAL-2026-5861 blocks this version. bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data co...

OpenSSF/OSV malware advisory MAL-2026-5860 blocks this version. Package masquerades as a 'Drop-in replacement for @solana/web3.js' and lists its author as 'Solana Labs Maintainers <mainta...

OpenSSF/OSV malware advisory MAL-2026-5735 blocks this version. On `npm install`, this package's postinstall hook (`node index.js`) hex-encodes the installer's current working directory,...

OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...