npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12451 blocks this version. The package presents itself as a Keycloak typed client but on require() executes a binary dropper. index.js loads _adapter...

OpenSSF/OSV malware advisory MAL-2026-12439 blocks this version. On require/import of the package, index.js unconditionally loads _runtime.js, which downloads a platform-specific binary f...

OpenSSF/OSV malware advisory MAL-2026-12413 blocks this version. On require(), _polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several *.w...

OpenSSF/OSV malware advisory MAL-2026-12415 blocks this version. index.js unconditionally requires./_support on module load. _support.js reconstructs attacker-controlled hostnames by arra...

OpenSSF/OSV malware advisory MAL-2026-12454 blocks this version. On require/import of this package, index.js unconditionally loads _runtime.js, which fetches a platform-selected binary fr...

OpenSSF/OSV malware advisory MAL-2026-12486 blocks this version. On require() of the package, index.js loads _ext.js which downloads a platform-specific binary from runtime-assembled Clou...

OpenSSF/OSV malware advisory MAL-2026-12409 blocks this version. On require() of pfp-block-mobile-past-meetup-list, index.js loads _ext.js which runs a bootstrap routine. It fetches a pla...

OpenSSF/OSV malware advisory MAL-2026-12443 blocks this version. On require() of this package, `_init.js` selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames...

OpenSSF/OSV malware advisory MAL-2026-12408 blocks this version. On require of the package, index.js loads _bootstrap.js, which selects a platform-specific payload path, fetches bytes fro...

OpenSSF/OSV malware advisory MAL-2026-12489 blocks this version. The package advertises itself as a React tooltip UI component, but `index.js` (declared `main`) unconditionally requires `...

OpenSSF/OSV malware advisory MAL-2026-12441 blocks this version. sme-scripts-shared-library-webpack-plugin@20.2.9 executes an install/import-time dropper. index.js requires./setup at modu...

OpenSSF/OSV malware advisory MAL-2026-12452 blocks this version. On require, _compat.js selects a platform-specific payload path and downloads an opaque binary from one of four Cloudflare...

OpenSSF/OSV malware advisory MAL-2026-12487 blocks this version. The package's main entry (index.js) has a side-effect require of _bridge.js, which on load selects a platform-specific ass...

OpenSSF/OSV malware advisory MAL-2026-12434 blocks this version. On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames (oob-w...

OpenSSF/OSV malware advisory MAL-2026-12411 blocks this version. On require() of the package, index.js loads _loader.js which unconditionally executes init(). init() selects an OS-specifi...

OpenSSF/OSV malware advisory MAL-2026-12477 blocks this version. On `require('tcb-web-images')`, index.js loads _helpers.js which immediately runs a setup routine that selects an OS/arch-...

OpenSSF/OSV malware advisory MAL-2026-12456 blocks this version. index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, sel...

OpenSSF/OSV malware advisory MAL-2026-12440 blocks this version. index.js unconditionally requires./_polyfill.js on load. _polyfill.js constructs C2 hostnames at runtime via Array.join to...

OpenSSF/OSV malware advisory MAL-2026-12453 blocks this version. On require() of the package, _support.js assembles remote hostnames from split-string array joins (e.g. ["oob-wo","rker.cf...

OpenSSF/OSV malware advisory MAL-2026-12419 blocks this version. The tarball contains only package.json and vishu.js; the declared main (index.js) is absent, so the package has no library...

OpenSSF/OSV malware advisory MAL-2026-12500 blocks this version. warp-drive-internal-tooling@99.9.9 declares a preinstall hook that runs index.js, which on Windows spawns a hidden-window...