npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14317 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../p...

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../p...

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../p...

OpenSSF/OSV malware advisory MAL-2026-14331 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On any require/import of exam-kit, the main entry ru...

OpenSSF/OSV malware advisory MAL-2026-12186 blocks this version. On require('pfp-forms-insurance-health'), index.js loads _compat.js which immediately invokes a dropper routine. It select...

OpenSSF/OSV malware advisory MAL-2026-5450 blocks this version. The package name impersonates the OpenMRS O3 forms ecosystem (legitimate packages are published under the @openmrs/ scope)....

OpenSSF/OSV malware advisory MAL-2026-5450 blocks this version. The package name impersonates the OpenMRS O3 forms ecosystem (legitimate packages are published under the @openmrs/ scope)....

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-6579 blocks this version. lessload@1.0.1 impersonates the popular `debug` package (replicating its API surface, contributor list, and description as...

OpenSSF/OSV malware advisory MAL-2026-12393 blocks this version. On require('invest-module-cookie'), index.js loads _adapter.js which selects an OS-specific asset path, downloads an opaqu...

OpenSSF/OSV malware advisory MAL-2026-12390 blocks this version. On require of the package, index.js loads _helpers.js which downloads a platform-specific executable from a rotating list...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...