npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11460 blocks this version. lib/report.js imports child_process, fs, https, and os and collects host identity and environment data via os.hostname(),...

OpenSSF/OSV malware advisory MAL-2026-5390 blocks this version. On `npm install`, the package's postinstall.js script enumerates all of process.env and collects host identifiers (os.hostn...

OpenSSF/OSV malware advisory MAL-2026-5387 blocks this version. On `npm install`, this package automatically executes postinstall.js, which enumerates the entire process.env (every enviro...

OpenSSF/OSV malware advisory MAL-2026-5388 blocks this version. On `npm install`, postinstall.js enumerates the full process.env keyspace plus host identifiers (os.hostname(), username, h...

OpenSSF/OSV malware advisory MAL-2026-5389 blocks this version. On `npm install`, postinstall.js enumerates every entry in process.env (sorted), bundles it with hostname, username, homedi...

OpenSSF/OSV malware advisory MAL-2026-5391 blocks this version. On `npm install`, postinstall.js enumerates every process.env variable (including credentials such as AWS_*, NPM_TOKEN, GIT...

OpenSSF/OSV malware advisory MAL-2026-11467 blocks this version. lib/report.js imports child_process, fs, https, and os, collects host identity via os.hostname() and os.userInfo(), execut...

OpenSSF/OSV malware advisory MAL-2026-11467 blocks this version. lib/report.js imports child_process, fs, https, and os, collects host identity via os.hostname() and os.userInfo(), execut...

OpenSSF/OSV malware advisory MAL-2026-5386 blocks this version. On `npm install`, postinstall.js enumerates all of process.env, collects hostname, username, homedir, cwd, argv, platform/a...

OpenSSF/OSV malware advisory MAL-2026-5385 blocks this version. On `npm install`, postinstall.js enumerates the entire process environment (Object.keys(process.env).sort().forEach) along...

OpenSSF/OSV malware advisory MAL-2026-11454 blocks this version. The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/G...

OpenSSF/OSV malware advisory MAL-2026-11456 blocks this version. The package's postinstall hook invokes lib/report.js, which harvests the developer's email (queried via `gh api user/email...

OpenSSF/OSV malware advisory MAL-2026-11455 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11454 blocks this version. The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/G...

OpenSSF/OSV malware advisory MAL-2026-11453 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11454 blocks this version. The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/G...

OpenSSF/OSV malware advisory MAL-2026-11434 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11430 blocks this version. npm package list-issue-predecessor-dependencies-block@99.0.0 auto-executes index.js from three lifecycle hooks (preinstall...

OpenSSF/OSV malware advisory MAL-2026-11427 blocks this version. package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP v...

OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...