npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

OpenSSF/OSV malware advisory MAL-2026-6678 blocks this version. On npm install, the package's postinstall script (test.js) invokes routines in index.js that recursively scan the current w...

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

OpenSSF/OSV malware advisory MAL-2026-6677 blocks this version. On `npm install`, the package's postinstall hook (`node test.js`) executes a multi-stage attack against the installer. (1)...

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

OpenSSF/OSV malware advisory MAL-2026-6708 blocks this version. zyncmap@0.0.0 advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function...

OpenSSF/OSV malware advisory MAL-2026-6708 blocks this version. zyncmap@0.0.0 advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function...