npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15538 blocks this version. package.json at line 11 declares a dependency whose key equals the package's own name (librastandardlib) and whose value i...

OpenSSF/OSV malware advisory MAL-2026-15543 blocks this version. package.json line 11 declares a dependency whose key equals the package's own name (`prm-bundles`) and whose value is a ba...

OpenSSF/OSV malware advisory MAL-2026-15542 blocks this version. package.json declares a dependency whose key equals the package's own name (paper-password-input) and whose value is a bar...

OpenSSF/OSV malware advisory MAL-2026-15541 blocks this version. package.json declares a dependency whose key (`oit-lib-oracle-util`) matches this package's own name and whose value is a...

OpenSSF/OSV malware advisory MAL-2026-15537 blocks this version. package.json line 11 declares a dependency whose key equals the package's own name (`jira-projects-backbone`) with a value...

OpenSSF/OSV malware advisory MAL-2026-15533 blocks this version. package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL (https://...

OpenSSF/OSV malware advisory MAL-2026-15535 blocks this version. package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridste...

OpenSSF/OSV malware advisory MAL-2026-15539 blocks this version. package.json line 11 declares a dependency whose source is a bare URL rather than a registry version range: "loading-perfo...

OpenSSF/OSV malware advisory MAL-2026-15534 blocks this version. package.json declares a single dependency whose value is a bare HTTP URL (https://repo.securityctrl.com/firestore-lite) ra...

OpenSSF/OSV malware advisory MAL-2026-15540 blocks this version. package.json declares a dependency whose key ("mkt-ui-library") equals the package's own name and whose value is a bare HT...

OpenSSF/OSV malware advisory MAL-2026-15530 blocks this version. package.json declares a dependency whose key equals the package's own name (`confluence-create-content`) and whose value i...

OpenSSF/OSV malware advisory MAL-2026-15526 blocks this version. package.json at line 11 declares a dependency whose key equals this package's own name (analytics-web-client) and whose so...

OpenSSF/OSV malware advisory MAL-2026-15536 blocks this version. package.json declares a dependency whose key equals the package's own name (`ir-annuities-client-authentication-module`) a...

OpenSSF/OSV malware advisory MAL-2026-15532 blocks this version. package.json declares a self-referential dependency whose key equals the package's own name (`confluence-rest`) and whose...

OpenSSF/OSV malware advisory MAL-2026-15544 blocks this version. package.json declares a self-referential dependency where the key `sentrykit` maps to the bare HTTPS URL `https://repo.sec...

OpenSSF/OSV malware advisory MAL-2026-15531 blocks this version. package.json declares a dependency whose value is a bare HTTPS URL (https://repo.securityctrl.com/confluence-editor) rathe...

OpenSSF/OSV malware advisory MAL-2026-15520 blocks this version. package.json declares a dependency whose key equals the package's own name (ring-device-settings-library) and whose value...

OpenSSF/OSV malware advisory MAL-2026-15525 blocks this version. package.json declares a single dependency whose source is a bare HTTPS URL (https://repo.securityctrl.com/amplitude-react-...

OpenSSF/OSV malware advisory MAL-2026-15529 blocks this version. package.json declares a dependency whose key equals this package's own name (bui-react-10themes) and whose value is a bare...

OpenSSF/OSV malware advisory MAL-2026-15527 blocks this version. package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctr...

OpenSSF/OSV malware advisory MAL-2026-15498 blocks this version. package.json declares a dependency whose key equals the package's own name (`aws-blog`) with a value of `https://repo.secu...