npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-5918 blocks this version. This package is one of ~95 names in a coordinated spam-publication family (nottuff1-30, ishowfeet1-20, imillegal1-5, abuden...

OpenSSF/OSV malware advisory MAL-2026-10323 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10321 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10315 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10314 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10327 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10310 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10308 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10345 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Any computer that has this package installed or runn...

OpenSSF/OSV malware advisory MAL-2026-10342 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-5917 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package ships a Scramjet-based web proxy (sw.js servi...

OpenSSF/OSV malware advisory MAL-2026-10319 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10326 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball ships `auto-publish.sh`, a script that r...

OpenSSF/OSV malware advisory MAL-2026-10283 blocks this version. package.json declares a dependency `safe-chain-test` sourced from a tarball URL on an anonymous Cloudflare tunnel host (`p...

OpenSSF/OSV malware advisory MAL-2026-10265 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10262 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10259 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10278 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10277 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...