npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10348 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10343 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10359 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10357 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10355 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10346 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10317 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10329 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10328 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10322 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10307 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10309 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10291 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10294 blocks this version. The tarball ships `auto-publish.sh`, a script that republishes the same payload under ~100 distinct npm names (`ishowfeet1...

OpenSSF/OSV malware advisory MAL-2026-10293 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-10292 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-10118 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code