npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13753 blocks this version. dcfarguscert@999.0.1 registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install,...

OpenSSF/OSV malware advisory MAL-2026-13754 blocks this version. package.json declares `postinstall: node index.js`, causing index.js to run automatically on `npm install`. The script col...

OpenSSF/OSV malware advisory MAL-2026-13752 blocks this version. The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.host...

OpenSSF/OSV malware advisory MAL-2026-13744 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's postinstall script POSTs installer met...

OpenSSF/OSV malware advisory MAL-2026-11071 blocks this version. whs4_eud@1.0.1 declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On e...

OpenSSF/OSV malware advisory MAL-2026-13743 blocks this version. On npm install, the package's postinstall hook runs `node index.js`, which POSTs installer host information — the absolute...

OpenSSF/OSV malware advisory MAL-2026-11070 blocks this version. package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's a...

OpenSSF/OSV malware advisory MAL-2026-13742 blocks this version. The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), o...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13741 blocks this version. safe-local-env-loader impersonates the legitimate `dotenv` package: its description, repository, homepage, and lib/main.js...

OpenSSF/OSV malware advisory MAL-2026-13694 blocks this version. env-local presents itself as a dotenv-compatible.env loader (README, keywords, and API mirror motdotla/dotenv), but lib/ma...

OpenSSF/OSV malware advisory MAL-2026-13735 blocks this version. @aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liq...

OpenSSF/OSV malware advisory MAL-2026-13735 blocks this version. @aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liq...

OpenSSF/OSV malware advisory MAL-2026-13734 blocks this version. @aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate func...

OpenSSF/OSV malware advisory MAL-2026-13734 blocks this version. @aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate func...

OpenSSF/OSV malware advisory MAL-2026-13738 blocks this version. @openzeppelin-5/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13738 blocks this version. @openzeppelin-5/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13737 blocks this version. @openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...