npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12494 blocks this version. ventrix-kit@1.5.2 ships a loader that, when the package's default `getPlugin` export is invoked, performs an HTTP request...

OpenSSF/OSV malware advisory MAL-2026-10989 blocks this version. package.json declares scripts.preinstall as `node./dist/index.d.js`, which runs automatically on `npm install`. dist/index...

OpenSSF/OSV malware advisory MAL-2026-12422 blocks this version. quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant....

OpenSSF/OSV malware advisory MAL-2026-12484 blocks this version. The package's declared main entry launcher.js invokes launch() at top level, so require('trailserver') triggers system-lev...

OpenSSF/OSV malware advisory MAL-2026-12312 blocks this version. Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches...

OpenSSF/OSV malware advisory MAL-2026-12312 blocks this version. Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12313 blocks this version. The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent (module github.com/ccfly/rescue) that, when ex...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-13323 blocks this version. On require, index.js loads _ext.js which detects platform, constructs C2 hostnames by joining split string fragments (e.g....