npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14007 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14009 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14013 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14009 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14013 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14013 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14007 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14007 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-10405 blocks this version. @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/he...

OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...

OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...

OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...

OpenSSF/OSV malware advisory MAL-2026-6275 blocks this version. The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrappe...

OpenSSF/OSV malware advisory MAL-2026-10405 blocks this version. @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/he...

OpenSSF/OSV malware advisory MAL-2026-5913 blocks this version. Package is published as `mastraqqq` but bundles a verbatim clone of the legitimate `mastra` CLI: the embedded package metad...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...

OpenSSF/OSV malware advisory MAL-2026-4422 blocks this version. Package `@qwedqwed/axios` is published under a scope that does not belong to the real axios maintainers but copies axios's...