npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14461 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14470 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14467 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14460 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14454 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14453 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14456 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14452 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14458 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14478 blocks this version. On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../...

OpenSSF/OSV malware advisory MAL-2026-14472 blocks this version. cscasereadserv-paypal@3.4.3 executes a preinstall script that auto-runs on `npm install`. The script collects the installe...

OpenSSF/OSV malware advisory MAL-2026-14471 blocks this version. The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are H...

OpenSSF/OSV malware advisory MAL-2026-14483 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares the package's own name, module...

OpenSSF/OSV malware advisory MAL-2026-14473 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares the package's own name `css-im...

OpenSSF/OSV malware advisory MAL-2026-14481 blocks this version. The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script in...

OpenSSF/OSV malware advisory MAL-2026-14481 blocks this version. The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script in...

OpenSSF/OSV malware advisory MAL-2026-14479 blocks this version. The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every...

OpenSSF/OSV malware advisory MAL-2026-14479 blocks this version. The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every...

OpenSSF/OSV malware advisory MAL-2026-14448 blocks this version. The package's index.html impersonates Google Classroom (title, gstatic favicon, hardcoded student email student111@risd.ed...

OpenSSF/OSV malware advisory MAL-2026-14446 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code