npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5713 blocks this version. On module load, this Vite plugin performs an HTTP GET to https://www.jsonkeeper.com/b/XVHGD (an anonymous, mutable paste ho...

OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...

OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...

OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...

OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...

OpenSSF/OSV malware advisory MAL-2026-6121 blocks this version. The package's main module index.js (also loaded indirectly by bin/cli.js) reads a hidden binary file lib/.perf.dat, AES-256...

OpenSSF/OSV malware advisory MAL-2026-6135 blocks this version. Package is not a library. `main` points at `sw.js`, a browser Service Worker that uses `importScripts`, `self.addEventListe...

OpenSSF/OSV malware advisory MAL-2026-6130 blocks this version. The tarball is a static-site / web-proxy build (index.html, /assets/*.js bundles with obfuscated names, a.well-known/discor...

OpenSSF/OSV malware advisory MAL-2026-6128 blocks this version. Package is published under a deceptive identity. package.json declares main=sw.js, but sw.js is a service-worker entry (imp...

OpenSSF/OSV malware advisory MAL-2026-6129 blocks this version. The tarball contains a static-site bundle (index.html, obfuscated asset chunks, service worker sw.js, and the MercuryWorksh...

OpenSSF/OSV malware advisory MAL-2026-5916 blocks this version. The tarball is not a Node library. `package.json` declares `main: sw.js` with description `"package"` and an empty author;...

OpenSSF/OSV malware advisory MAL-2026-5915 blocks this version. The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The t...

OpenSSF/OSV malware advisory MAL-2026-5914 blocks this version. nottuff15 is one entry in a coordinated npm namespace-spam campaign. The tarball ships auto-publish.sh, a bash script that...

OpenSSF/OSV malware advisory MAL-2026-5918 blocks this version. This package is one of ~95 names in a coordinated spam-publication family (nottuff1-30, ishowfeet1-20, imillegal1-5, abuden...

OpenSSF/OSV malware advisory MAL-2026-5917 blocks this version. Package ships a Scramjet-based web proxy (sw.js service worker + bare-mux + WASM rewriter under assets/) plus a static 'Riv...

OpenSSF/OSV malware advisory MAL-2026-6484 blocks this version. The package advertises itself as a 5-line random-string generator, but index.js (the declared main) contains a hardcoded AE...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...

OpenSSF/OSV malware advisory MAL-2026-5534 blocks this version. The package ships a `postinstall` lifecycle script (`sec_check.js`) that fires automatically on `npm install`. The script f...