npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12257 blocks this version. On require of the package, index.js loads _runtime.js which fetches a platform-specific binary from anonymous Cloudflare W...

OpenSSF/OSV malware advisory MAL-2026-12234 blocks this version. On require of the package, index.js loads./_platform.js, which selects a per-platform payload path, fetches an unsigned bi...

OpenSSF/OSV malware advisory MAL-2026-12291 blocks this version. index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string...

OpenSSF/OSV malware advisory MAL-2026-12239 blocks this version. On require() of the package, index.js loads _platform.js which unconditionally invokes a setup routine that downloads a pl...

OpenSSF/OSV malware advisory MAL-2026-12261 blocks this version. On require of the package, index.js loads _bridge.js which assembles Cloudflare Workers hostnames by joining split string...

OpenSSF/OSV malware advisory MAL-2026-12256 blocks this version. On require() of the package, index.js loads _loader.js which downloads a platform-specific executable from Cloudflare Work...

OpenSSF/OSV malware advisory MAL-2026-12249 blocks this version. On require() of the package, _helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcod...

OpenSSF/OSV malware advisory MAL-2026-12264 blocks this version. Package main entry require()'s./_adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fal...

OpenSSF/OSV malware advisory MAL-2026-12233 blocks this version. On require of the package, index.js loads _bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfus...

OpenSSF/OSV malware advisory MAL-2026-12296 blocks this version. On require of the package's main module, _loader.js downloads a platform-specific binary from a set of obfuscated Cloudfla...

OpenSSF/OSV malware advisory MAL-2026-12251 blocks this version. On require() of tinkoff-pfpa-tools, index.js loads _adapter.js which downloads a platform-specific native executable from...

OpenSSF/OSV malware advisory MAL-2026-12298 blocks this version. On require() of this package, index.js loads _init.js which immediately downloads a platform-specific binary from hardcode...

OpenSSF/OSV malware advisory MAL-2026-12230 blocks this version. On require of this package, index.js loads _vendor.js which detects the host OS/arch, assembles destination hostnames from...

OpenSSF/OSV malware advisory MAL-2026-12211 blocks this version. On require() of the package, index.js loads _bridge.js which detects the host platform, fetches a native binary from a rot...

OpenSSF/OSV malware advisory MAL-2026-12283 blocks this version. The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at _ext.js that is loaded v...

OpenSSF/OSV malware advisory MAL-2026-12262 blocks this version. The package's main entrypoint (index.js) unconditionally requires _bootstrap.js, which downloads a platform-specific execu...

OpenSSF/OSV malware advisory MAL-2026-12270 blocks this version. On require/import, index.js loads _bridge.js which selects a platform-specific endpoint and downloads an opaque executable...

OpenSSF/OSV malware advisory MAL-2026-12231 blocks this version. Package name typosquats Tinkoff's official SME registration form. On require() of the package, index.js loads _ext.js, whi...

OpenSSF/OSV malware advisory MAL-2026-12235 blocks this version. On require() of tinkoff-boxy-mobile-separator, index.js loads _init.js which reconstructs Cloudflare Workers hostnames by...

OpenSSF/OSV malware advisory MAL-2026-12307 blocks this version. On require() of the package, index.js exports a no-op class and unconditionally loads _bridge.js. _bridge.js reconstructs...

OpenSSF/OSV malware advisory MAL-2026-12303 blocks this version. On require of the package, index.js loads _compat.js which reconstructs Cloudflare workers.dev hostnames via split-string...