npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13813 blocks this version. Package hgdvfuflnb@1.0.0 contains a single file, index.html, declared as the package main. The HTML impersonates a Cloudfl...

OpenSSF/OSV malware advisory MAL-2026-13818 blocks this version. The package contains a single file, index.html, declared as the package `main`. The HTML is styled as a Cloudflare Turnsti...

OpenSSF/OSV malware advisory MAL-2026-13818 blocks this version. The package contains a single file, index.html, declared as the package `main`. The HTML is styled as a Cloudflare Turnsti...

OpenSSF/OSV malware advisory MAL-2026-13818 blocks this version. The package contains a single file, index.html, declared as the package `main`. The HTML is styled as a Cloudflare Turnsti...

OpenSSF/OSV malware advisory MAL-2026-13880 blocks this version. On `npm install`, the preinstall hook (scripts/check-env.js) runs a host-reconnaissance sweep — whoami, id, uname, ip/rout...

OpenSSF/OSV malware advisory MAL-2026-13787 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package ships a compiled Next.js application (server...

OpenSSF/OSV malware advisory MAL-2026-13787 blocks this version. Package ships a compiled Next.js application (server routes under app/.next-cli-build/server/app/api/) implementing an LLM...

OpenSSF/OSV malware advisory MAL-2026-13779 blocks this version. No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files conta...

OpenSSF/OSV malware advisory MAL-2026-13779 blocks this version. No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files conta...

OpenSSF/OSV malware advisory MAL-2026-13779 blocks this version. No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files conta...

OpenSSF/OSV malware advisory MAL-2026-13784 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's sole content is a single obfuscated HT...

OpenSSF/OSV malware advisory MAL-2026-13823 blocks this version. Package mnmobicom@1.0.0 was scanned with 2 files and no static or behavioral findings were produced. No lifecycle scripts,...

OpenSSF/OSV malware advisory MAL-2026-13826 blocks this version. The tarball contains just index.html and package.json (main: index.html). index.html mimics a Cloudflare Turnstile challen...

OpenSSF/OSV malware advisory MAL-2026-13799 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package contains a single index.html file declar...

OpenSSF/OSV malware advisory MAL-2026-13811 blocks this version. The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page...

OpenSSF/OSV malware advisory MAL-2026-13838 blocks this version. Package contains only package.json and index.html, with main pointing at index.html. The HTML impersonates a Cloudflare 'J...

OpenSSF/OSV malware advisory MAL-2026-13837 blocks this version. Package unitel3@1.0.0 contains 2 files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

OpenSSF/OSV malware advisory MAL-2026-13785 blocks this version. Package's main entry is index.html, a page styled as a Cloudflare Turnstile challenge. The inline script is obfuscator.io-...

OpenSSF/OSV malware advisory MAL-2026-13800 blocks this version. Package cvvkshuelwiu@1.0.0 contains 2 files with no a static rule matches and no traced behaviors of concern. No install-t...

OpenSSF/OSV malware advisory MAL-2026-13830 blocks this version. The package contains only index.html (declared as main in package.json) and no JavaScript entry point, lifecycle scripts,...