npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13770 blocks this version. @telekom-ods/react-ui-kit@2.6.9 ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner....

OpenSSF/OSV malware advisory MAL-2026-13882 blocks this version. package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js shells out via chil...

OpenSSF/OSV malware advisory MAL-2026-13881 blocks this version. On `npm install`, the package's preinstall hook executes index.js, which collects installer identity and host information...

OpenSSF/OSV malware advisory MAL-2026-13881 blocks this version. On `npm install`, the package's preinstall hook executes index.js, which collects installer identity and host information...

OpenSSF/OSV malware advisory MAL-2026-13815 blocks this version. Package contains a single index.html declared as `main` that impersonates a Cloudflare 'Just a moment…' verification page,...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13769 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. No a static rule matches or traced behavior indicati...

OpenSSF/OSV malware advisory MAL-2026-13768 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Analysis of the package did not surface install-time life...

OpenSSF/OSV malware advisory MAL-2026-13768 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Analysis of the package did not surface install-time life...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13844 blocks this version. Package contains only index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13835 blocks this version. Package truecxikdsal@1.0.0 contains 2 files and no static or traced findings indicate exfiltration, install-time code exec...

OpenSSF/OSV malware advisory MAL-2026-13796 blocks this version. Package cvbmxiowkwqla6@1.0.0 contains only two files and no behaviors matching supply-chain attack patterns were identifie...

OpenSSF/OSV malware advisory MAL-2026-13792 blocks this version. Package chmjdsidwlf5@1.0.0 contains 2 files with no a static rule matches and no traced behavior indicating exfiltration,...

OpenSSF/OSV malware advisory MAL-2026-13807 blocks this version. The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no preinsta...