npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5250 blocks this version. No concrete installer-harm evidence was identified in this version of executable-stories-cypress. No lifecycle hook payload...

OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...

OpenSSF/OSV malware advisory MAL-2026-5256 blocks this version. No concrete installer-harm signals were identified in this version. No lifecycle hooks fetching remote payloads, no credent...

OpenSSF/OSV malware advisory MAL-2026-5211 blocks this version. Pattern matches fired on co-occurrence of the strings 'ping', 'POST', and 'hostname' in the package's bundled and source fi...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5254 blocks this version. No concrete installer-harm signals were identified for this package version. No lifecycle scripts, hardcoded network destin...

OpenSSF/OSV malware advisory MAL-2026-5224 blocks this version. No concrete installer-harm signals were identified for this package version. No lifecycle hooks, network destinations, cred...

OpenSSF/OSV malware advisory MAL-2026-5239 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5235 blocks this version. No concrete indicators of installer-side harm were identified in this package version. No lifecycle hooks fetching remote p...

OpenSSF/OSV malware advisory MAL-2026-5238 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5237 blocks this version. No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related asy...

OpenSSF/OSV malware advisory MAL-2026-5221 blocks this version. No concrete installer-harm evidence was identified for this package version. No lifecycle-script droppers, credential reads...

OpenSSF/OSV malware advisory MAL-2026-5246 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5236 blocks this version. No concrete installer-harm signals were identified in this package version. The package name combines 'awaitly' and 'libsql...

OpenSSF/OSV malware advisory MAL-2026-5258 blocks this version. No concrete installer-harm indicators were identified in this package version. No lifecycle-script behavior, network beacon...

OpenSSF/OSV malware advisory MAL-2026-5250 blocks this version. No concrete installer-harm evidence was identified in this version of executable-stories-cypress. No lifecycle hook payload...

OpenSSF/OSV malware advisory MAL-2026-5256 blocks this version. No concrete installer-harm signals were identified in this version. No lifecycle hooks fetching remote payloads, no credent...

OpenSSF/OSV malware advisory MAL-2026-5225 blocks this version. No concrete installer-harm evidence was identified in this version of autotel-mongoose. The package name resembles the popu...

OpenSSF/OSV malware advisory MAL-2026-5254 blocks this version. No concrete installer-harm signals were identified for this package version. No lifecycle scripts, hardcoded network destin...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5223 blocks this version. Pattern-based matches fired on the strings 'ping' and 'POST' co-occurring in the package's bundled output (dist/index.cjs,...