npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6762 blocks this version. node-pino is a one-edit typosquat of the popular `pino` logger that ships repackaged `winston` plus a malicious `postinstal...

OpenSSF/OSV malware advisory MAL-2026-6761 blocks this version. On npm install, postinstall.js executes automatically and collects installer host identifiers (os.hostname(), os.userInfo()...

OpenSSF/OSV malware advisory MAL-2026-6760 blocks this version. The OpenSSF Package Analysis project identified '@adobesign/as-dev-tools' @ 99.9.10 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-6760 blocks this version. The OpenSSF Package Analysis project identified '@adobesign/as-dev-tools' @ 99.9.10 (npm) as malicious.

Source inspection confirms malicious functionality in both published entrypoints that is unrelated to Base58 encoding. The activation guard weakens reachability but the package still carr...

The package has concrete malicious install-time behavior: a hidden obfuscated postinstall with host reconnaissance, command execution primitives, filesystem mutation, detached execution,...

Source inspection confirms a malicious install-time hook with hidden execution, persistence-like detached launch behavior, and system telemetry collection. The benign README and metadata...

The lifecycle hook is a concrete install-time dropper/launcher, not merely telemetry or package-aligned setup. The obfuscation, anti-analysis, detached execution, and broken advertised mo...

The package has concrete unconsented install-time execution with obfuscation, process spawning, filesystem mutation, and telemetry behavior that exceeds the declared ESLint-config purpose...

Direct source inspection confirms the only substantive behavior is an automatic postinstall command with no legitimate package purpose. Although there is no exfiltration or persistence, u...

The source establishes a concrete install-time remote payload path with disabled TLS verification and no integrity check. Even without credential theft or immediate binary execution, this...

Source inspection confirms a lifecycle-triggered remote executable payload install from a non-registry IP endpoint with TLS verification disabled. Even without credential theft or immedia...

This package uses an npm lifecycle hook to install an opaque executable from a hardcoded remote IP with certificate validation disabled and no source-visible integrity check. That creates...

OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...

Source inspection shows concrete phishing/spam automation, sender spoofing, webmail injection, and evasion features rather than benign package-aligned functionality. The install hooks are...

Source inspection confirms a concrete install-time destructive action via rmSync against broad global/user binary paths. Package-aligned CLI env sync and auth behavior is not itself malic...

OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...

OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...

OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...

OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...

Static inspection confirms concrete protestware in the shipped main bundle, despite otherwise package-aligned checkout API behavior and no install hook. Because the code can intentionally...