npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-13726 blocks this version. LPM AI assessed this version as clean; the assessments disagree. svelte-kit-streak@1.0.0 was scanned across 8 files with n...

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-13727 blocks this version. No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libra...

OpenSSF/OSV malware advisory MAL-2026-13725 blocks this version. Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator...