npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6482 blocks this version. On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: i...

OpenSSF/OSV malware advisory MAL-2026-11089 blocks this version. No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionali...

OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...

OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...

OpenSSF/OSV malware advisory MAL-2026-6437 blocks this version. On npm install, scripts/install-check.cjs (registered as a postinstall lifecycle script) fetches a JSON config from a hardc...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11349 blocks this version. No malicious behavior was identified in this package version. There is no evidence of credential access, environment scrap...

OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...

OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...

OpenSSF/OSV malware advisory MAL-2026-11328 blocks this version. Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-6438 blocks this version. The package ships a `postinstall` hook (`scripts/sync-peer.cjs`) that runs on every default `npm install`. The script compa...