npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10364 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10334 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10305 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10429 blocks this version. The package's declared npm postinstall script collects the installer's username (os.userInfo().username), hostname (os.hos...

OpenSSF/OSV malware advisory MAL-2026-10574 blocks this version. Package name impersonates the widely-used vite-plugin-tsconfig-paths (the package.json homepage points to the legitimate p...

OpenSSF/OSV malware advisory MAL-2026-10573 blocks this version. The exported registerGracefulShutdown() API — advertised in the README as a small server-helper for graceful shutdown, hea...

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10474 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10474 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10474 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...

OpenSSF/OSV malware advisory MAL-2026-10475 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10474 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6496 blocks this version. Package `@dervix/ws` impersonates the popular `ws` WebSocket library — `package.json` copies the legitimate ws project's ho...

OpenSSF/OSV malware advisory MAL-2026-10573 blocks this version. The exported registerGracefulShutdown() API — advertised in the README as a small server-helper for graceful shutdown, hea...

OpenSSF/OSV malware advisory MAL-2026-10573 blocks this version. The exported registerGracefulShutdown() API — advertised in the README as a small server-helper for graceful shutdown, hea...

OpenSSF/OSV malware advisory MAL-2026-10220 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10521 blocks this version. @flcik/flick.js@3.1.2 replicates the discord.js public API surface (FlickClient, GatewayIntentBits, SlashCommandBuilder, B...