npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14053 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. depcruise-baseline@99.9.1 has a name resembling depe...

OpenSSF/OSV malware advisory MAL-2026-14056 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. gunzip-js@99.9.1 is a near-empty npm package (typosq...

OpenSSF/OSV malware advisory MAL-2026-13687 blocks this version. On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://b...

OpenSSF/OSV malware advisory MAL-2026-14067 blocks this version. upload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), proc...

OpenSSF/OSV malware advisory MAL-2026-14065 blocks this version. Package published under a name impersonating Akamai's sensor_data anti-bot SDK. index.js contains a /*... */ comment whose...

OpenSSF/OSV malware advisory MAL-2026-14066 blocks this version. The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. in...

OpenSSF/OSV malware advisory MAL-2026-12337 blocks this version. The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a...

OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...

OpenSSF/OSV malware advisory MAL-2026-14052 blocks this version. The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.from(hex, 'hex...

OpenSSF/OSV malware advisory MAL-2026-14063 blocks this version. On npm install, preinstall/postinstall scripts execute `id`, read environment variables including AWS_LAMBDA_LOG_STREAM_NA...

OpenSSF/OSV malware advisory MAL-2026-14063 blocks this version. On npm install, preinstall/postinstall scripts execute `id`, read environment variables including AWS_LAMBDA_LOG_STREAM_NA...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...