npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12103 blocks this version. @wethenorth12/spl-token-utils advertises itself as a drop-in replacement for @solana/spl-token. On require(), index.js ser...

OpenSSF/OSV malware advisory MAL-2026-12102 blocks this version. On require of the package's main entry (index.js), the code collects process.env, hostname, username, homedir, platform, c...

OpenSSF/OSV malware advisory MAL-2026-12101 blocks this version. On require(), index.js JSON-encodes the full process.env plus hostname, username, homedir, platform, cwd, and package meta...

OpenSSF/OSV malware advisory MAL-2026-12100 blocks this version. @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collec...

OpenSSF/OSV malware advisory MAL-2026-12099 blocks this version. @wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require(), index.js collects process.env, h...

OpenSSF/OSV malware advisory MAL-2026-12098 blocks this version. Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require('near-api...

OpenSSF/OSV malware advisory MAL-2026-12096 blocks this version. index.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-...

OpenSSF/OSV malware advisory MAL-2026-12095 blocks this version. @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require,...

OpenSSF/OSV malware advisory MAL-2026-12094 blocks this version. The package presents itself as a drop-in replacement for the ethers library (author metadata `ethers-io`, repository URL p...

OpenSSF/OSV malware advisory MAL-2026-12093 blocks this version. On require(), index.js collects the host's hostname, username, home directory, platform, current working directory, and th...

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12092 blocks this version. @wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' a...

OpenSSF/OSV malware advisory MAL-2026-12091 blocks this version. On require(), index.js reads the full process.env map along with hostname, username, homedir, platform, and cwd, JSON-stri...

OpenSSF/OSV malware advisory MAL-2026-12089 blocks this version. On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and PO...

OpenSSF/OSV malware advisory MAL-2026-12087 blocks this version. On require(), index.js reads the entire process.env plus host identifiers (hostname, username, homedir, platform, cwd, tim...

OpenSSF/OSV malware advisory MAL-2026-12088 blocks this version. On require(), index.js collects the full process.env object together with hostname, username, home directory, platform, cu...

OpenSSF/OSV malware advisory MAL-2026-12086 blocks this version. On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and th...

OpenSSF/OSV malware advisory MAL-2026-12085 blocks this version. Package presents itself as a drop-in replacement for the popular `bip39` library but ships a credential stealer in its mai...