npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-14352 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14352 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14352 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14378 blocks this version. package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hos...

OpenSSF/OSV malware advisory MAL-2026-14377 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, p...

OpenSSF/OSV malware advisory MAL-2026-14366 blocks this version. index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameW...

OpenSSF/OSV malware advisory MAL-2026-14365 blocks this version. The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/ra...

OpenSSF/OSV malware advisory MAL-2026-14364 blocks this version. The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket...

OpenSSF/OSV malware advisory MAL-2026-14363 blocks this version. The package consists of a minimal HTML wrapper (index.html) whose only behavior is to fetch content from a hardcoded, unpi...

OpenSSF/OSV malware advisory MAL-2026-14362 blocks this version. index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL https://bitbucket.org/p2p-alt-public...

OpenSSF/OSV malware advisory MAL-2026-14366 blocks this version. index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameW...

OpenSSF/OSV malware advisory MAL-2026-14365 blocks this version. The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/ra...

OpenSSF/OSV malware advisory MAL-2026-14364 blocks this version. The package's main entry contains a top-level IIFE that runs on module load and fetches content from a hardcoded Bitbucket...

OpenSSF/OSV malware advisory MAL-2026-14363 blocks this version. The package consists of a minimal HTML wrapper (index.html) whose only behavior is to fetch content from a hardcoded, unpi...

OpenSSF/OSV malware advisory MAL-2026-14362 blocks this version. index.js is a top-level async IIFE that fetches HTML from the hardcoded, unpinned URL https://bitbucket.org/p2p-alt-public...

OpenSSF/OSV malware advisory MAL-2026-14371 blocks this version. The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball shi...

OpenSSF/OSV malware advisory MAL-2026-14379 blocks this version. Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and...

OpenSSF/OSV malware advisory MAL-2026-14379 blocks this version. Package advertises itself as a TOTP utility but its postinstall script (`node./index.js --setup 2>/dev/null || true`) and...