npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5159 blocks this version. po-ops-local-dev@99.9.1 has no functional code of its own (index.js contains only `module.exports = {};` and there are no l...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...

OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...

OpenSSF/OSV malware advisory MAL-2026-5648 blocks this version. On `npm install`, the package's postinstall.js collects `os.hostname()` and `os.userInfo().username` and embeds them as que...

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

OpenSSF/OSV malware advisory MAL-2026-5153 blocks this version. Package @att-ebiz/abs-components-bc@99.9.1 is an empty placeholder published to public npm under a scope (@att-ebiz) that m...

OpenSSF/OSV malware advisory MAL-2026-5884 blocks this version. On `npm install`, the `preinstall` hook (`node lib/setup.js`) runs on Windows and invokes `lib/worker.js`, which downloads...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-5150 blocks this version. On `npm install`, the package's preinstall script (preinstall.js) collects the installer's hostname, OS username, current w...

OpenSSF/OSV malware advisory MAL-2026-6192 blocks this version. nodepathbalance54 exports a single function (`nodeaxionweb`) whose implementation is hidden inside a hand-rolled stack-base...

OpenSSF/OSV malware advisory MAL-2026-5972 blocks this version. On `npm install`, the package's postinstall lifecycle script (postinstall.js) collects installer-side host identifiers — os...

OpenSSF/OSV malware advisory MAL-2026-5900 blocks this version. Package name `chai-as-decrypted` mimics the popular `chai-as-promised`, and the README impersonates `pino` (uses pino's npm...

OpenSSF/OSV malware advisory MAL-2026-2891 blocks this version. chai-as-init is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/c2e881b8bc0f...

OpenSSF/OSV malware advisory MAL-2026-2509 blocks this version. Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility b...

OpenSSF/OSV malware advisory MAL-2026-5753 blocks this version. Package advertises trivial form-validation helpers (notEmpty/isEmail/isPhone/maxLen/minLen) but on require/import of the ma...

OpenSSF/OSV malware advisory MAL-2026-5139 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...

OpenSSF/OSV malware advisory MAL-2026-5140 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...

OpenSSF/OSV malware advisory MAL-2026-5133 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...

OpenSSF/OSV malware advisory MAL-2026-5142 blocks this version. Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared...