npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12137 blocks this version. On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process....

OpenSSF/OSV malware advisory MAL-2026-12127 blocks this version. index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on...

OpenSSF/OSV malware advisory MAL-2026-12127 blocks this version. index.js (the package main) require()s setup.js, which schedules bootstrap() on process.nextTick, so the dropper fires on...

OpenSSF/OSV malware advisory MAL-2026-12137 blocks this version. On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process....

OpenSSF/OSV malware advisory MAL-2026-12140 blocks this version. On require() of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a pl...

OpenSSF/OSV malware advisory MAL-2026-12136 blocks this version. The package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end...

OpenSSF/OSV malware advisory MAL-2026-12135 blocks this version. The package advertises itself as an 'Accounts offers library' but on require() index.js silently loads setup.js, which via...

OpenSSF/OSV malware advisory MAL-2026-12138 blocks this version. Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load,...

OpenSSF/OSV malware advisory MAL-2026-12139 blocks this version. The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling...

OpenSSF/OSV malware advisory MAL-2026-12117 blocks this version. Package declares a postinstall script that runs dist/index.js, the sole shipped file, which is heavily obfuscated with jav...

OpenSSF/OSV malware advisory MAL-2026-12123 blocks this version. @zzzgenesis00/solana-spl-token@0.4.0 impersonates the Solana SPL Token package and runs postinstall.js on `npm install`. T...

OpenSSF/OSV malware advisory MAL-2026-12122 blocks this version. The package's postinstall.js lifecycle script runs on `npm install` and collects installer-side secrets: it enumerates a h...

OpenSSF/OSV malware advisory MAL-2026-12121 blocks this version. @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates ~/.ssh, ~/.npm...

OpenSSF/OSV malware advisory MAL-2026-12120 blocks this version. On npm install, postinstall.js reads installer-owned secret material — ~/.ssh entries, ~/.npmrc, ~/.gitconfig — and iterat...

OpenSSF/OSV malware advisory MAL-2026-12118 blocks this version. @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfilt...

OpenSSF/OSV malware advisory MAL-2026-12119 blocks this version. This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious beha...

OpenSSF/OSV malware advisory MAL-2026-12125 blocks this version. @zzzgenesis00/web3-utils-crypto ships a postinstall.js that runs automatically on npm install and harvests installer-side...

OpenSSF/OSV malware advisory MAL-2026-12124 blocks this version. This package impersonates the legitimate `tronweb` SDK (author field spoofed as 'tronprotocol') and runs a malicious posti...

OpenSSF/OSV malware advisory MAL-2026-11710 blocks this version. npm/@or-sdk/library-types-v2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Sh...

OpenSSF/OSV malware advisory MAL-2026-11706 blocks this version. npm/@or-sdk/library is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...

OpenSSF/OSV malware advisory MAL-2026-11711 blocks this version. npm/@or-sdk/lookup is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud:...