npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12309 blocks this version. On require of the package (index.js loads./_vendor at import), _vendor.js selects a platform-specific staging path, downlo...

OpenSSF/OSV malware advisory MAL-2026-12224 blocks this version. dist/index.js appends `eval(atob('...'))` after the legitimate CSS-plugin export, so simply importing or requiring the pac...

OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...

OpenSSF/OSV malware advisory MAL-2026-12217 blocks this version. index.js appends a large base64-encoded, unicode-escaped payload after ~11 KB of whitespace padding, executed via eval(ato...

OpenSSF/OSV malware advisory MAL-2026-12216 blocks this version. stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and uncondit...

OpenSSF/OSV malware advisory MAL-2026-12267 blocks this version. On require() of the package's main index.js, _loader.js selects a platform-specific endpoint and fetches an opaque native...

OpenSSF/OSV malware advisory MAL-2026-12286 blocks this version. On require of the package, index.js loads _bridge.js which selects a platform-specific payload path, fetches bytes over HT...

OpenSSF/OSV malware advisory MAL-2026-12254 blocks this version. Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./_init on load...

OpenSSF/OSV malware advisory MAL-2026-12238 blocks this version. The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require(), index.js loads _shim.js,...

OpenSSF/OSV malware advisory MAL-2026-12301 blocks this version. index.js unconditionally requires./_init on module load. _init.js assembles host names at runtime via array join to hide t...

OpenSSF/OSV malware advisory MAL-2026-12241 blocks this version. On module load, index.js requires./_shim.js, which immediately runs a dropper: it fetches an opaque platform-specific bina...

OpenSSF/OSV malware advisory MAL-2026-12247 blocks this version. On require, index.js loads _ext.js which reconstructs endpoint hostnames from split string fragments (oob-worker.cf100-416...

OpenSSF/OSV malware advisory MAL-2026-12282 blocks this version. On require of this package, _platform.js reconstructs endpoint hostnames from split string arrays via.join(""), downloads...

OpenSSF/OSV malware advisory MAL-2026-12248 blocks this version. On require() of index.js, the package silently loads _bootstrap.js, which reconstructs attacker-controlled hostnames from...

OpenSSF/OSV malware advisory MAL-2026-12253 blocks this version. On require of the package, _adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardc...

OpenSSF/OSV malware advisory MAL-2026-12277 blocks this version. The package's main entry require()'s _loader.js, which at import time downloads a per-platform binary from string-concaten...

OpenSSF/OSV malware advisory MAL-2026-12271 blocks this version. The package is presented as a trivial event emitter but its main entry (index.js) auto-loads _bootstrap.js on require(). _...

OpenSSF/OSV malware advisory MAL-2026-12300 blocks this version. On require(), index.js loads _init.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hos...

OpenSSF/OSV malware advisory MAL-2026-12299 blocks this version. On require() of this package, index.js loads _adapter.js which selects a platform-specific asset path (/pkg/package, /pkg/...

OpenSSF/OSV malware advisory MAL-2026-12295 blocks this version. On require of the package's main index.js, _support.js reconstructs attacker-controlled hostnames from string-split arrays...

OpenSSF/OSV malware advisory MAL-2026-12246 blocks this version. index.js unconditionally require()s./_ext inside a swallowed try/catch. _ext.js is a platform-aware dropper: it constructs...