npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13937 blocks this version. Package impersonates the ethers project (real releases publish under `ethers` and `@ethersproject/*`, not `@ethers-js`). T...

OpenSSF/OSV malware advisory MAL-2026-13941 blocks this version. Package name @solana-js/web3 impersonates the legitimate @solana/web3.js SDK, and package.json falsely attributes authorsh...

OpenSSF/OSV malware advisory MAL-2026-13930 blocks this version. npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsl...

OpenSSF/OSV malware advisory MAL-2026-13930 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web...

OpenSSF/OSV malware advisory MAL-2026-13931 blocks this version. npm/@dreamguyxeon/libsignal-node has the same import-time supply-chain tampering as @dgxeon13/libsignal-node@1.0.0: on req...

OpenSSF/OSV malware advisory MAL-2026-13930 blocks this version. npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsl...

OpenSSF/OSV malware advisory MAL-2026-13930 blocks this version. npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsl...

OpenSSF/OSV malware advisory MAL-2026-13929 blocks this version. npm/@dgxeon13/libsignal-node impersonates Signal's libsignal Node binding. On require of index.js, after a short delay it...

OpenSSF/OSV malware advisory MAL-2026-13978 blocks this version. Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts....

OpenSSF/OSV malware advisory MAL-2026-13978 blocks this version. Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts....

OpenSSF/OSV malware advisory MAL-2026-13934 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The preinstall lifecycle script in preinstall.js iss...

OpenSSF/OSV malware advisory MAL-2026-13955 blocks this version. The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When r...

OpenSSF/OSV malware advisory MAL-2026-13982 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. in-install@99.9.1 declares its `ltidisafe` dependenc...

OpenSSF/OSV malware advisory MAL-2026-13983 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package `knip-bun` typosquats the popular `knip` lin...

OpenSSF/OSV malware advisory MAL-2026-13977 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package name resembles the widely-used 'cspell' library b...

OpenSSF/OSV malware advisory MAL-2026-13987 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. resolve-audit@99.9.1 is a stub package (index export...

OpenSSF/OSV malware advisory MAL-2026-13976 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. check-audit@99.9.1 is an otherwise empty package (no...

OpenSSF/OSV malware advisory MAL-2026-13981 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. eslint-publish-release@99.9.1 is a hollow package (i...

OpenSSF/OSV malware advisory MAL-2026-13980 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. eslint-generate-release@99.9.1 is a hollow package w...

OpenSSF/OSV malware advisory MAL-2026-13979 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package ships an empty module (index.js = 'module.ex...