npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-12051 blocks this version. On require of the package's main entry, _compat.js downloads a platform-specific binary from Cloudflare Workers subdomains...

OpenSSF/OSV malware advisory MAL-2026-12042 blocks this version. The package's index.js unconditionally loads _bridge.js on require. _bridge.js downloads a platform-specific native binary...

OpenSSF/OSV malware advisory MAL-2026-12049 blocks this version. On require of the package, _platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers host...

OpenSSF/OSV malware advisory MAL-2026-12050 blocks this version. The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload...

OpenSSF/OSV malware advisory MAL-2026-12041 blocks this version. On require() of the package, index.js loads./_compat.js whose top-level init() downloads a platform-specific binary from a...

OpenSSF/OSV malware advisory MAL-2026-12034 blocks this version. On require('beaver-ui-form-modal'), index.js loads _shim.js which downloads a platform-specific binary from string-array-o...

OpenSSF/OSV malware advisory MAL-2026-12039 blocks this version. The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install an...

OpenSSF/OSV malware advisory MAL-2026-12039 blocks this version. The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install an...

OpenSSF/OSV malware advisory MAL-2026-12054 blocks this version. index.js has malicious code appended after a legitimate Tailwind plugin export. On any require()/import of the package, th...

OpenSSF/OSV malware advisory MAL-2026-12047 blocks this version. index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct refe...

OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...

OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...

OpenSSF/OSV malware advisory MAL-2026-11869 blocks this version. npm/@servicetitan/forge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...

OpenSSF/OSV malware advisory MAL-2026-11857 blocks this version. npm/@servicetitan/dte-unlayer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...

OpenSSF/OSV malware advisory MAL-2026-11866 blocks this version. npm/@servicetitan/examples is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai...

OpenSSF/OSV malware advisory MAL-2026-11847 blocks this version. npm/@servicetitan/cp-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hu...

OpenSSF/OSV malware advisory MAL-2026-11850 blocks this version. npm/@servicetitan/datadog-rum is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "S...

OpenSSF/OSV malware advisory MAL-2026-11856 blocks this version. npm/@servicetitan/dte-pdf-editor is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the...