npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-12813 blocks this version. On npm install, the package's postinstall script executes index.js, which collects host identifiers (os.hostname(), os.use...

OpenSSF/OSV malware advisory MAL-2026-12793 blocks this version. The `helixbox-connect` bin opens a WebSocket to the hardcoded relay `wss://helixbox-relay.onrender.com` and dispatches mes...

OpenSSF/OSV malware advisory MAL-2026-12496 blocks this version. package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site...

OpenSSF/OSV malware advisory MAL-2026-12473 blocks this version. table-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-le...

OpenSSF/OSV malware advisory MAL-2026-12422 blocks this version. quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant....

OpenSSF/OSV malware advisory MAL-2026-12511 blocks this version. application_base@9999.0.0 runs callback.js from its preinstall lifecycle hook on `npm install`. The script collects os.hos...

OpenSSF/OSV malware advisory MAL-2026-12512 blocks this version. Package name `appsignal` shadows the legitimate `@appsignal/*` scope and is published at version `9999.0.0`, a version-num...

OpenSSF/OSV malware advisory MAL-2026-12505 blocks this version. The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispa...

OpenSSF/OSV malware advisory MAL-2026-12514 blocks this version. Package name typosquats `async-mutex` but ships unrelated functionality. The default export `getPlugin` in index.js issues...

OpenSSF/OSV malware advisory MAL-2026-12509 blocks this version. On npm install, the package's postinstall hook (scripts.postinstall: 'node dist/recon.js || true') automatically runs dist...

OpenSSF/OSV malware advisory MAL-2026-12509 blocks this version. On npm install, the package's postinstall hook (scripts.postinstall: 'node dist/recon.js || true') automatically runs dist...

OpenSSF/OSV malware advisory MAL-2026-12509 blocks this version. On npm install, the package's postinstall hook (scripts.postinstall: 'node dist/recon.js || true') automatically runs dist...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12437 blocks this version. dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload quer...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...