npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

OpenSSF/OSV malware advisory MAL-2026-12767 blocks this version. On require of the package, index.js loads _bridge.js, which assembles platform-specific destination hostnames via string-s...

OpenSSF/OSV malware advisory MAL-2026-12768 blocks this version. index.js unconditionally requires./_loader on load. _loader.js reassembles Cloudflare workers.dev hostnames (oob-worker.cf...

OpenSSF/OSV malware advisory MAL-2026-12781 blocks this version. index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudf...

OpenSSF/OSV malware advisory MAL-2026-12789 blocks this version. The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it...

OpenSSF/OSV malware advisory MAL-2026-12794 blocks this version. The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home d...

OpenSSF/OSV malware advisory MAL-2026-12800 blocks this version. The package's preinstall script runs automatically on `npm install` and collects installer-side identifiers — `os.hostname...

OpenSSF/OSV malware advisory MAL-2026-12804 blocks this version. store-locator-widget@9999.0.0 ships an empty library body (index.js exports `{}`) and a preinstall hook (`node callback.js...

OpenSSF/OSV malware advisory MAL-2026-12801 blocks this version. sc-payment-utils@9999.0.0 declares a preinstall script that executes callback.js on npm install. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12815 blocks this version. widget-forge@9999.0.0 is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', whi...

OpenSSF/OSV malware advisory MAL-2026-12786 blocks this version. On `npm install`, the package's `preinstall` script runs `node callback.js`, which collects `os.hostname()`, `os.userInfo(...

OpenSSF/OSV malware advisory MAL-2026-12788 blocks this version. package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifie...

OpenSSF/OSV malware advisory MAL-2026-12811 blocks this version. The package's postinstall script (scripts/install-check.cjs) reads a bundle URL from https://polymarket-clob-service.verce...

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-12816 blocks this version. package.json declares a preinstall hook that runs index.js during `npm install`. The script reads /etc/passwd, /etc/hosts,...

OpenSSF/OSV malware advisory MAL-2026-11147 blocks this version. On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.16...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...