npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11757 blocks this version. npm/@ornikar/intl-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-H...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13495 blocks this version. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogg...

OpenSSF/OSV malware advisory MAL-2026-13668 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-13633 blocks this version. On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) t...

OpenSSF/OSV malware advisory MAL-2026-13402 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. lib/Socket/messages-send.js contains network destina...

OpenSSF/OSV malware advisory MAL-2026-13400 blocks this version. agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-sess...

OpenSSF/OSV malware advisory MAL-2026-13661 blocks this version. The package is advertised as a finance/payments adapter but on require() reaches a staged loader. `_adapter.js` reconstruc...

OpenSSF/OSV malware advisory MAL-2026-13660 blocks this version. On require() of the package, index.js loads./_polyfill.js which assembles a set of C2 hostnames from split string fragment...

OpenSSF/OSV malware advisory MAL-2026-13659 blocks this version. On require() of this package, index.js loads./_loader.js which reconstructs C2 hostnames via array-join string concealment...

OpenSSF/OSV malware advisory MAL-2026-13658 blocks this version. On require() of the package, index.js loads _support.js and lib/telemetry.js, both of which reconstruct the identifier 'ch...

OpenSSF/OSV malware advisory MAL-2026-13646 blocks this version. On require() of the package, index.js loads _bridge.js which assembles Cloudflare Workers subdomain hostnames from split s...

OpenSSF/OSV malware advisory MAL-2026-13633 blocks this version. On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) t...

OpenSSF/OSV malware advisory MAL-2026-13631 blocks this version. On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https...