npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12429 blocks this version. The npm package rollup-plugins-check@0.0.2 declares a postinstall script (`node dist/module.js`) that, on `npm install`, p...

OpenSSF/OSV malware advisory MAL-2026-12429 blocks this version. The npm package rollup-plugins-check@0.0.2 declares a postinstall script (`node dist/module.js`) that, on `npm install`, p...

OpenSSF/OSV malware advisory MAL-2026-12430 blocks this version. rollup-plugins-polyfills-rode@0.13.1 is a typosquat of rollup-plugin-polyfill-node (whose repository URL it copies verbati...

OpenSSF/OSV malware advisory MAL-2026-12430 blocks this version. rollup-plugins-polyfills-rode@0.13.1 is a typosquat of rollup-plugin-polyfill-node (whose repository URL it copies verbati...

OpenSSF/OSV malware advisory MAL-2026-12470 blocks this version. streak-metricsa@1.0.0 presents itself as a calendar-day math helper but its main entry (dist/index.mjs, the default `expor...

OpenSSF/OSV malware advisory MAL-2026-12478 blocks this version. package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded ba...

OpenSSF/OSV malware advisory MAL-2026-12478 blocks this version. package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded ba...

OpenSSF/OSV malware advisory MAL-2026-12478 blocks this version. package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded ba...

OpenSSF/OSV malware advisory MAL-2026-12494 blocks this version. ventrix-kit@1.5.2 ships a loader that, when the package's default `getPlugin` export is invoked, performs an HTTP request...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-12496 blocks this version. package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site...

OpenSSF/OSV malware advisory MAL-2026-12497 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, use...

OpenSSF/OSV malware advisory MAL-2026-11065 blocks this version. Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install ti...

OpenSSF/OSV malware advisory MAL-2026-12473 blocks this version. table-ui-new@2.7.4 ships dist/config.js, exposed via the package.json `./config` subpath export, which exports a module-le...

OpenSSF/OSV malware advisory MAL-2026-12436 blocks this version. shift-sdk-v5@5.0.1 registers a postinstall script that runs dist/recon.js on npm install. The script collects hostname, us...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12425 blocks this version. package.json declares `preinstall: node./dist/index.d.js`, disguising an executable loader as a TypeScript declaration fil...

OpenSSF/OSV malware advisory MAL-2026-12462 blocks this version. index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants (`process`,...

OpenSSF/OSV malware advisory MAL-2026-12457 blocks this version. streak-bucket-core@1.0.0 advertises itself as a small dependency-free calendar/day-math helper library, but its declared m...

OpenSSF/OSV malware advisory MAL-2026-12464 blocks this version. streak-daybucket@1.0.0 presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Window...