npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14035 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`. The script uses child_proce...

OpenSSF/OSV malware advisory MAL-2026-14035 blocks this version. package.json declares a postinstall lifecycle script that runs automatically on `npm install`. The script uses child_proce...

OpenSSF/OSV malware advisory MAL-2026-14034 blocks this version. package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metad...

OpenSSF/OSV malware advisory MAL-2026-14034 blocks this version. package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metad...

OpenSSF/OSV malware advisory MAL-2026-14034 blocks this version. package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metad...

OpenSSF/OSV malware advisory MAL-2026-14034 blocks this version. package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metad...

OpenSSF/OSV malware advisory MAL-2026-14034 blocks this version. package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metad...

OpenSSF/OSV malware advisory MAL-2026-14038 blocks this version. The package presents itself as a Tailwind CSS plugin, but its default export (which runs when users register it in tailwin...

OpenSSF/OSV malware advisory MAL-2026-14030 blocks this version. The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS r...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...

OpenSSF/OSV malware advisory MAL-2026-5835 blocks this version. On `npm install`, the package's `postinstall` hook runs `sec_check.js`, which enumerates the host's network interfaces and...

OpenSSF/OSV malware advisory MAL-2026-14019 blocks this version. The OpenSSF Package Analysis project identified 'fr-ito-web-react' @ 99.99.99 (npm) as malicious.