npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14269 blocks this version. The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSync(BI...

OpenSSF/OSV malware advisory MAL-2026-14264 blocks this version. package.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.c...

OpenSSF/OSV malware advisory MAL-2026-14265 blocks this version. package.json declares `"postinstall": "sudo node install.js"`, escalating to root on `npm install`. install.js is heavily...

OpenSSF/OSV malware advisory MAL-2026-14266 blocks this version. Package published as `electron-sessions` advertises itself as generic 'Session utilities' but ships a single 1.18MB heavil...

OpenSSF/OSV malware advisory MAL-2026-13342 blocks this version. index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (load...

OpenSSF/OSV malware advisory MAL-2026-14268 blocks this version. package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppa...

OpenSSF/OSV malware advisory MAL-2026-14262 blocks this version. The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hos...

OpenSSF/OSV malware advisory MAL-2026-14258 blocks this version. The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses creat...

OpenSSF/OSV malware advisory MAL-2026-14260 blocks this version. package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarbal...

OpenSSF/OSV malware advisory MAL-2026-14259 blocks this version. package.json declares the dependency `@whiskeysockets/baileys` but resolves it from `github:rcedubot/X` instead of the npm...

OpenSSF/OSV malware advisory MAL-2026-12422 blocks this version. quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant....

OpenSSF/OSV malware advisory MAL-2026-14256 blocks this version. api-rs-tuils@2.1.6 runs a malicious postinstall hook (`node test.js`) that executes obfuscated code in index.js against th...

OpenSSF/OSV malware advisory MAL-2026-14254 blocks this version. The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance ove...

OpenSSF/OSV malware advisory MAL-2026-14251 blocks this version. The package's postinstall lifecycle script collects installer host identifiers (hostname, platform, architecture, Node ver...

OpenSSF/OSV malware advisory MAL-2026-14249 blocks this version. localize-extract@1.0.0 executes a postinstall script that collects host identifiers (os.hostname(), platform, arch, node v...

OpenSSF/OSV malware advisory MAL-2026-14255 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package name mimics the widely used `secp256k1` cryp...

OpenSSF/OSV malware advisory MAL-2026-14255 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package name mimics the widely used `secp256k1` cryp...

OpenSSF/OSV malware advisory MAL-2026-14255 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package name mimics the widely used `secp256k1` cryp...

OpenSSF/OSV malware advisory MAL-2026-14252 blocks this version. npm-wold@1.1.1 declares a postinstall script (`node dist/config.js`) that, on `npm install`, issues an HTTPS GET to the ha...

OpenSSF/OSV malware advisory MAL-2026-14252 blocks this version. npm-wold@1.1.1 declares a postinstall script (`node dist/config.js`) that, on `npm install`, issues an HTTPS GET to the ha...