npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12216 blocks this version. stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and uncondit...

OpenSSF/OSV malware advisory MAL-2026-13344 blocks this version. On Windows, `npm install ezfnfix` automatically executes a bundled Windows PE binary via a postinstall hook. package.json...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-13350 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The shipped Windows-x64 prebuilt `hello.node` embeds...

OpenSSF/OSV malware advisory MAL-2026-12797 blocks this version. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and...

OpenSSF/OSV malware advisory MAL-2026-13342 blocks this version. index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (load...

OpenSSF/OSV malware advisory MAL-2026-12386 blocks this version. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12386 blocks this version. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-11139 blocks this version. kordyn@0.9.14 advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities ('...

OpenSSF/OSV malware advisory MAL-2026-11139 blocks this version. kordyn@0.9.14 advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities ('...

OpenSSF/OSV malware advisory MAL-2026-13348 blocks this version. lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a s...

OpenSSF/OSV malware advisory MAL-2026-13347 blocks this version. javas-crypto ships a postinstall hook (package.json line 11: "postinstall": "node setup.js") and a top-level autoExecute()...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

OpenSSF/OSV malware advisory MAL-2026-13357 blocks this version. On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesti...

OpenSSF/OSV malware advisory MAL-2026-13209 blocks this version. The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespok...

OpenSSF/OSV malware advisory MAL-2026-13210 blocks this version. The package's package.json declares its dependency "@openai/codex" as a direct tarball URL: https://gitcode.com/api/v5/rep...

OpenSSF/OSV malware advisory MAL-2026-13217 blocks this version. akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode var...

OpenSSF/OSV malware advisory MAL-2026-13216 blocks this version. The package hides an executable payload inside a block comment in index.js using Unicode variation selectors (U+FE00–U+FE0...

OpenSSF/OSV malware advisory MAL-2026-13175 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On require('dolyame-ui-popup'), index.js loads _help...