npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-12378 blocks this version. The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-13368 blocks this version. express-dever@5.1.8 registers `postinstall: node index.js` in package.json, and index.js is heavily obfuscated (obfuscator...

OpenSSF/OSV malware advisory MAL-2026-13368 blocks this version. express-dever@5.1.8 registers `postinstall: node index.js` in package.json, and index.js is heavily obfuscated (obfuscator...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-4508 blocks this version. The package contains code in dist/entry.js and dist/index.js that invokes `npm publish` programmatically combined with `wri...

OpenSSF/OSV malware advisory MAL-2026-13366 blocks this version. package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes...