npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11081 blocks this version. Package name `amanexzyra-baileys` resembles the popular WhatsApp Web API library `@whiskeysockets/baileys` family, which h...

OpenSSF/OSV malware advisory MAL-2026-6368 blocks this version. The postinstall script scripts/sync-peer.cjs runs `npm pack decimal-format-utils@1.0.1` (or whatever version is configured...

OpenSSF/OSV malware advisory MAL-2026-11081 blocks this version. Package name `amanexzyra-baileys` resembles the popular WhatsApp Web API library `@whiskeysockets/baileys` family, which h...

OpenSSF/OSV malware advisory MAL-2026-10892 blocks this version. claude-code-timer@1.0.0 was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network ca...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-6320 blocks this version. ts-escrow@0.1.0 is a verbatim copy of the big.js library (README, repository URL, author, version banner, and description a...

OpenSSF/OSV malware advisory MAL-2026-11088 blocks this version. sixbails is a WhatsApp Web library (Baileys-family fork). On every socket creation — the package's primary documented API...

OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-6319 blocks this version. The package ships a verbatim copy of MikeMcl/big.js v7.0.1 (same banner, MIT copyright, and API) but is published under a d...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-6338 blocks this version. index.js imports child_process and invokes execSync with bash and zsh shell strings (around lines 315 and 331). The pattern...

OpenSSF/OSV malware advisory MAL-2026-10891 blocks this version. No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity,...

OpenSSF/OSV malware advisory MAL-2026-6067 blocks this version. The CLI binary at bin/scan-only.js, when invoked (e.g., via `npx scan-only --diagnose`), harvests installer-side secrets an...

OpenSSF/OSV malware advisory MAL-2026-10891 blocks this version. No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity,...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10698 blocks this version. The package ships a single file, index.html, which is declared as the package `main`. On render, index.html fetches https:...

OpenSSF/OSV malware advisory MAL-2026-10897 blocks this version. Package self-identifies as a security research test ('Security research test - do not install'). The package.json `homepag...

OpenSSF/OSV malware advisory MAL-2026-11014 blocks this version. The package advertises itself as a high-throughput bulk-mail tool and ships every one of its ~50 JS files (cli.js, denv.js...