npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14060 blocks this version. The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the...

OpenSSF/OSV malware advisory MAL-2026-11043 blocks this version. The npm package `supplyhub` is a credential / SSH-key stealer. Its `package.json` declares a `postinstall` lifecycle hook...

OpenSSF/OSV malware advisory MAL-2026-14058 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball stages an obfuscated JavaScript payload...

OpenSSF/OSV malware advisory MAL-2026-14057 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js shells out vi...

OpenSSF/OSV malware advisory MAL-2026-14055 blocks this version. The package declares a preinstall lifecycle script (preinstall.js) that reads a hex-encoded command from preinstall.json,...

OpenSSF/OSV malware advisory MAL-2026-14051 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package presents itself as a discord.js clone (`...

OpenSSF/OSV malware advisory MAL-2026-14051 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package presents itself as a discord.js clone (`...

OpenSSF/OSV malware advisory MAL-2026-14051 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package presents itself as a discord.js clone (`...

OpenSSF/OSV malware advisory MAL-2026-14051 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package presents itself as a discord.js clone (`...

OpenSSF/OSV malware advisory MAL-2026-14051 blocks this version. The package presents itself as a discord.js clone (`repository` field points at the real `github.com/discordjs/discord.js....

OpenSSF/OSV malware advisory MAL-2026-14048 blocks this version. The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xel...

OpenSSF/OSV malware advisory MAL-2026-14048 blocks this version. The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xel...

OpenSSF/OSV malware advisory MAL-2026-14050 blocks this version. package.json for @polymarkets/clob-client-v2 declares its inquirer dependency as an HTTPS tarball URL on registrynpmjs.to,...

OpenSSF/OSV malware advisory MAL-2026-14049 blocks this version. Package published to the public npm registry under the @mexc scope without evidence of scope ownership. package.json decla...

OpenSSF/OSV malware advisory MAL-2026-14048 blocks this version. The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xel...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships heavily obfuscated runtime files (...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships heavily obfuscated runtime files (...

OpenSSF/OSV malware advisory MAL-2026-14047 blocks this version. On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub...

OpenSSF/OSV malware advisory MAL-2026-14047 blocks this version. On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub...

OpenSSF/OSV malware advisory MAL-2026-14047 blocks this version. On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub...

OpenSSF/OSV malware advisory MAL-2026-14045 blocks this version. The npm package @ferudionz/webautomation exposes a single function connet(x) whose sole behavior is to POST the caller-sup...