npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13478 blocks this version. The package's preinstall lifecycle script runs on npm install and collects the installer's local username (whoami), hostna...

OpenSSF/OSV malware advisory MAL-2026-13478 blocks this version. The package's preinstall lifecycle script runs on npm install and collects the installer's local username (whoami), hostna...

OpenSSF/OSV malware advisory MAL-2026-13452 blocks this version. On plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13450 blocks this version. move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13452 blocks this version. On plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13450 blocks this version. move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install...

OpenSSF/OSV malware advisory MAL-2026-13450 blocks this version. move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install...

OpenSSF/OSV malware advisory MAL-2026-13397 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package implements a daemon that pairs with a re...

OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...

OpenSSF/OSV malware advisory MAL-2026-13445 blocks this version. server.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0....

OpenSSF/OSV malware advisory MAL-2026-13445 blocks this version. server.js starts an Express + WebSocket server via app.listen(PORT,...) with no host argument, defaulting the bind to 0.0....

OpenSSF/OSV malware advisory MAL-2026-13452 blocks this version. On plugin load, opencode-optimised-toolings@4.0.0 runs SelfPatchPlugin.runSelfPatch() without user prompt. It downloads an...

OpenSSF/OSV malware advisory MAL-2026-13209 blocks this version. The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespok...

OpenSSF/OSV malware advisory MAL-2026-13209 blocks this version. The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespok...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

OpenSSF/OSV malware advisory MAL-2026-13448 blocks this version. Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via...

OpenSSF/OSV malware advisory MAL-2026-13443 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. diezyyasha-baileys is a fork of the Baileys WhatsApp...