npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...

OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-12068 blocks this version. The npm package ledger-lib@1.0.0 presents itself as a Ledger hardware wallet library but ships no wallet functionality (in...

OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...

OpenSSF/OSV malware advisory MAL-2026-12067 blocks this version. hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads in...

OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12112 blocks this version. index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh...

OpenSSF/OSV malware advisory MAL-2026-12110 blocks this version. On npm install, the package's postinstall script (node postinstall.js, declared in package.json scripts.postinstall) reads...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-12078 blocks this version. trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and...

OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12115 blocks this version. The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spaw...

OpenSSF/OSV malware advisory MAL-2026-12113 blocks this version. This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-12109 blocks this version. bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the p...

OpenSSF/OSV malware advisory MAL-2026-12111 blocks this version. ethers-lib@1.0.4 impersonates the ethers.js ecosystem (name 'ethers-lib', description 'Essential crypto utility library',...

OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...

OpenSSF/OSV malware advisory MAL-2026-11483 blocks this version. The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network ac...