npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-10781 blocks this version. Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module...

OpenSSF/OSV malware advisory MAL-2026-10782 blocks this version. Package ships a single browser-side IIFE (index.js) that manipulates the DOM (inserts a banner into #root and calls window...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...

OpenSSF/OSV malware advisory MAL-2026-11104 blocks this version. Review of tailwind-motionkit@1.0.3 surfaced no evidence of exfiltration, install-time remote code execution, silent relay,...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-11023 blocks this version. Package `bs58-88` mimics the popular `bs58` base58 encoder: README, keywords, and repository URL match the real `bs58`, an...

OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. LPM AI assessed this version as clean; the assessments disagree. On npm install, scripts/install-check.cjs runs as a postin...

OpenSSF/OSV malware advisory MAL-2026-10498 blocks this version. package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:808...

OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...

OpenSSF/OSV malware advisory MAL-2026-6712 blocks this version. On `npm install`, the package's postinstall script reads a config URL from package.json's `homepage` field (https://parket-...

OpenSSF/OSV malware advisory MAL-2026-11029 blocks this version. lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a s...

OpenSSF/OSV malware advisory MAL-2026-11025 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltrati...

OpenSSF/OSV malware advisory MAL-2026-11025 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltrati...

OpenSSF/OSV malware advisory MAL-2026-10498 blocks this version. package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:808...

OpenSSF/OSV malware advisory MAL-2026-11028 blocks this version. No a static rule matches and no behavioral findings of concern were identified for helix-deploy@110.0.1. No install-time l...

OpenSSF/OSV malware advisory MAL-2026-11028 blocks this version. No a static rule matches and no behavioral findings of concern were identified for helix-deploy@110.0.1. No install-time l...

OpenSSF/OSV malware advisory MAL-2026-11081 blocks this version. Package name `amanexzyra-baileys` resembles the popular WhatsApp Web API library `@whiskeysockets/baileys` family, which h...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...