npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6523 blocks this version. On module load, index.js auto-invokes initPlugin(), which HTTP-GETs https://jsonkeeper.com/b/PRA3O, parses the JSON respons...

OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...

OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...

OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...

OpenSSF/OSV malware advisory MAL-2026-3763 blocks this version. The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The scr...

OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...

OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...

OpenSSF/OSV malware advisory MAL-2026-3762 blocks this version. The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declar...

OpenSSF/OSV malware advisory MAL-2026-6186 blocks this version. On npm install, package.json's postinstall script executes `curl http://9ph8dp.ceye.io`, an out-of-band DNS/HTTP interactio...

OpenSSF/OSV malware advisory MAL-2026-4830 blocks this version. The OpenSSF Package Analysis project identified 'editorial-code' @ 99.0.1 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-4831 blocks this version. The OpenSSF Package Analysis project identified 'editorial-mse-authentication-ui' @ 99.0.1 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-4132 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

OpenSSF/OSV malware advisory MAL-2026-4132 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

OpenSSF/OSV malware advisory MAL-2026-4132 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

OpenSSF/OSV malware advisory MAL-2026-5719 blocks this version. OSV/OpenSSF confirms ect-654321@100.0.8 as malicious package MAL-2026-5719. Malicious code in ect-654321 (npm)

OpenSSF/OSV malware advisory MAL-2026-5719 blocks this version. OSV/OpenSSF confirms ect-654321@100.0.7 as malicious package MAL-2026-5719. Malicious code in ect-654321 (npm)

OpenSSF/OSV malware advisory MAL-2026-5719 blocks this version. OSV/OpenSSF confirms ect-654321@100.0.4 as malicious package MAL-2026-5719. Malicious code in ect-654321 (npm)

OpenSSF/OSV malware advisory MAL-2026-5719 blocks this version. OSV/OpenSSF confirms ect-654321@100.0.3 as malicious package MAL-2026-5719. Malicious code in ect-654321 (npm)

OpenSSF/OSV malware advisory MAL-2026-5719 blocks this version. OSV/OpenSSF confirms ect-654321@100.0.2 as malicious package MAL-2026-5719. Malicious code in ect-654321 (npm)

OpenSSF/OSV malware advisory MAL-2026-5719 blocks this version. OSV/OpenSSF confirms ect-654321@100.0.1 as malicious package MAL-2026-5719. Malicious code in ect-654321 (npm)