npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14526 blocks this version. The package's package.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL (h...

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-14442 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13456 blocks this version. LPM AI review remains unresolved. santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js l...

OpenSSF/OSV malware advisory MAL-2026-14509 blocks this version. On npm install, the package's postinstall hook runs `node.worker.js`, which detaches a background child, waits a jittered...

OpenSSF/OSV malware advisory MAL-2026-14512 blocks this version. dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes `eval(atob('<~39KB base64>'))` at...

OpenSSF/OSV malware advisory MAL-2026-14491 blocks this version. On module load, lib/initializeCaller.js (required from index.js) runs an IIFE that POSTs the full process.env to a base64-...

OpenSSF/OSV malware advisory MAL-2026-14492 blocks this version. Package is published under a name resembling the legitimate 'spotify-url-info' but its shipped code is an exfiltration too...

OpenSSF/OSV malware advisory MAL-2026-14487 blocks this version. On require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules ev...

OpenSSF/OSV malware advisory MAL-2026-14455 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14457 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14485 blocks this version. Package presents itself as a zero-dependency TOTP library but its postinstall hook (`node lib/core.js`) and its advertised...

OpenSSF/OSV malware advisory MAL-2026-14485 blocks this version. Package presents itself as a zero-dependency TOTP library but its postinstall hook (`node lib/core.js`) and its advertised...

OpenSSF/OSV malware advisory MAL-2026-14484 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares the package's own name in both...

OpenSSF/OSV malware advisory MAL-2026-14482 blocks this version. This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every buil...

OpenSSF/OSV malware advisory MAL-2026-14480 blocks this version. The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml...

OpenSSF/OSV malware advisory MAL-2026-14480 blocks this version. The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml...

OpenSSF/OSV malware advisory MAL-2026-14480 blocks this version. The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml...