npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14462 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14469 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-1383 blocks this version. Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependenc...

OpenSSF/OSV malware advisory MAL-2026-1383 blocks this version. Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependenc...

OpenSSF/OSV malware advisory MAL-2026-14443 blocks this version. The OpenSSF Package Analysis project identified '@elc-online/up-analytics' @ 99.99.99 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-14416 blocks this version. On any `import 'dims-hydration-ui'`, index.mjs chmods 0755 and spawns a bundled Linux x86_64 ELF at dist/internal/calc.dat...

OpenSSF/OSV malware advisory MAL-2026-14418 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...

OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...

OpenSSF/OSV malware advisory MAL-2026-14404 blocks this version. Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do w...

OpenSSF/OSV malware advisory MAL-2026-14404 blocks this version. Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do w...

OpenSSF/OSV malware advisory MAL-2026-13456 blocks this version. santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) re...

OpenSSF/OSV malware advisory MAL-2026-14440 blocks this version. web-advertising@999.9.16 declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install....

OpenSSF/OSV malware advisory MAL-2026-14440 blocks this version. web-advertising@999.9.16 declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install....

OpenSSF/OSV malware advisory MAL-2026-14438 blocks this version. package.json declares `preinstall: node index.js`, so `npm install` automatically runs index.js. index.js reads os.hostnam...

OpenSSF/OSV malware advisory MAL-2026-14434 blocks this version. The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS server...

OpenSSF/OSV malware advisory MAL-2026-6497 blocks this version. chai-as-synced@7.0.9 impersonates the pino logger: it ships pino's README, LICENSE, docs/, index.d.ts and lib/ file layout...

OpenSSF/OSV malware advisory MAL-2026-14435 blocks this version. The package's npm preinstall lifecycle script collects the installer's OS username, hostname, current working directory, a...

OpenSSF/OSV malware advisory MAL-2026-14428 blocks this version. consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, ho...

OpenSSF/OSV malware advisory MAL-2026-14433 blocks this version. The package's preinstall lifecycle script fires automatically on npm install and collects the installer's OS username, hos...