npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14117 blocks this version. bcc-design@9999.0.0 is a dependency-confusion beacon package published at an implausibly high version to shadow an interna...

OpenSSF/OSV malware advisory MAL-2026-14076 blocks this version. bcs-mini presents itself as a BCS codec but contains an install/require-time payload in index.js that steals Sui wallet ma...

OpenSSF/OSV malware advisory MAL-2026-14116 blocks this version. The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-14116 blocks this version. The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-6590 blocks this version. On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE execu...

OpenSSF/OSV malware advisory MAL-2026-6590 blocks this version. On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE execu...

OpenSSF/OSV malware advisory MAL-2026-6590 blocks this version. On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE execu...

OpenSSF/OSV malware advisory MAL-2025-49362 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. At CLI startup, index.js downloads three native shar...

OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...

OpenSSF/OSV malware advisory MAL-2025-49192 blocks this version. The package epic-sso was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-49125 blocks this version. The package epic-common-node was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-49124 blocks this version. The package epic-common was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-6183 blocks this version. preinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hos...

OpenSSF/OSV malware advisory MAL-2026-5401 blocks this version. savant-listing@999.9.9 is a dependency-confusion squat. package.json declares both `install` and `postinstall` lifecycle sc...

OpenSSF/OSV malware advisory MAL-2026-5401 blocks this version. savant-listing@999.9.9 is a dependency-confusion squat. package.json declares both `install` and `postinstall` lifecycle sc...

OpenSSF/OSV malware advisory MAL-2026-3724 blocks this version. On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as que...

OpenSSF/OSV malware advisory MAL-2026-14087 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-3353 blocks this version. The package money-badger-open-rpc was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.