npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14236 blocks this version. The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers (os.h...

OpenSSF/OSV malware advisory MAL-2026-14226 blocks this version. plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a c...

OpenSSF/OSV malware advisory MAL-2026-14225 blocks this version. The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET t...

OpenSSF/OSV malware advisory MAL-2026-14225 blocks this version. The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET t...

OpenSSF/OSV malware advisory MAL-2026-14219 blocks this version. The package's lib/report.js requires child_process, fs, https, and os at the top of the module and constructs an HTTPS POS...

OpenSSF/OSV malware advisory MAL-2026-14224 blocks this version. streak-metric-test@1.0.0 ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level a...

OpenSSF/OSV malware advisory MAL-2026-14220 blocks this version. The npm package solidity-hold@2.0.1 impersonates the popular pino logger: the README badges and lib/ source tree are copie...

OpenSSF/OSV malware advisory MAL-2026-14221 blocks this version. ssb-test-package@1.0.0 is a dependency-confusion proof-of-concept. package.json declares `preinstall: node poc.js`, and po...

OpenSSF/OSV malware advisory MAL-2026-14218 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Unscoped npm package 'mapkit-loader' impersonates th...

OpenSSF/OSV malware advisory MAL-2026-14205 blocks this version. The package's install lifecycle script (scripts.install="node index.js") automatically executes on npm install and loads l...

OpenSSF/OSV malware advisory MAL-2026-14206 blocks this version. @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both `npm install` (via package.json scripts.instal...

OpenSSF/OSV malware advisory MAL-2026-14207 blocks this version. The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basena...

OpenSSF/OSV malware advisory MAL-2026-14204 blocks this version. Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo().us...

OpenSSF/OSV malware advisory MAL-2026-14210 blocks this version. On require('sui-graphql-rpc'), index.js loads lib/telemetry.js which reads ~/.gitconfig from the installer's home director...

OpenSSF/OSV malware advisory MAL-2026-14209 blocks this version. On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14212 blocks this version. On invocation, index.js spawns start_tool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute...

OpenSSF/OSV malware advisory MAL-2026-14213 blocks this version. The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload (pointer.py) th...