npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11490 blocks this version. The package contains three files and produced no a static rule matches and no traced code behaviors of concern. The name a...

OpenSSF/OSV malware advisory MAL-2026-11492 blocks this version. No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of insta...

OpenSSF/OSV malware advisory MAL-2026-11505 blocks this version. On require() of accounts-loading-state, index.js loads setup.js which schedules bootstrap() via process.nextTick. bootstra...

OpenSSF/OSV malware advisory MAL-2026-11390 blocks this version. No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code,...

OpenSSF/OSV malware advisory MAL-2026-11390 blocks this version. No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code,...

OpenSSF/OSV malware advisory MAL-2026-11391 blocks this version. The package contains no code paths matching supply-chain attack fingerprints: no install/postinstall lifecycle hooks fetch...

OpenSSF/OSV malware advisory MAL-2026-11500 blocks this version. index.js appends an eval(atob(...)) blob to an otherwise legitimate Tailwind plugin. On require(), the decoded loader quer...

OpenSSF/OSV malware advisory MAL-2026-11487 blocks this version. index.js hides a base64-encoded payload after a long run of tab characters and executes it via eval(atob(...)) at module l...

OpenSSF/OSV malware advisory MAL-2026-11103 blocks this version. stargateproxyserv@28.0.0 declares a `preinstall` script that runs `node index.js`, which collects installer host identifie...

OpenSSF/OSV malware advisory MAL-2026-11461 blocks this version. The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-ut...

OpenSSF/OSV malware advisory MAL-2026-11062 blocks this version. The package's preinstall hook executes index.js, which collects host identifiers (os.hostname(), os.platform(), os.arch(),...

OpenSSF/OSV malware advisory MAL-2026-11098 blocks this version. crm-reportinsightserv-paypal@28.0.0 executes a preinstall script (index.js) that collects installer host identifiers — os....

OpenSSF/OSV malware advisory MAL-2026-11058 blocks this version. payoutsvettingserv-paypal@28.0.0 declares `preinstall: node index.js` in package.json, causing index.js to run automatical...

OpenSSF/OSV malware advisory MAL-2026-11057 blocks this version. The package's preinstall script (index.js) executes automatically on `npm install` and collects host identifiers — hostnam...

OpenSSF/OSV malware advisory MAL-2026-11057 blocks this version. The package's preinstall script (index.js) executes automatically on `npm install` and collects host identifiers — hostnam...

OpenSSF/OSV malware advisory MAL-2026-11061 blocks this version. The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS serv...