npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6543 blocks this version. package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's m...

OpenSSF/OSV malware advisory MAL-2026-6062 blocks this version. The package ships several files whose names and contents suggest a non-trivial install-time and runtime footprint: a postin...

OpenSSF/OSV malware advisory MAL-2026-6062 blocks this version. The package ships several files whose names and contents suggest a non-trivial install-time and runtime footprint: a postin...

OpenSSF/OSV malware advisory MAL-2026-6111 blocks this version. The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfu...

OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...

OpenSSF/OSV malware advisory MAL-2026-5691 blocks this version. The package ships a postinstall.js that imports child_process and references HTTP GET and hostname operations. Without trac...

OpenSSF/OSV malware advisory MAL-2026-5687 blocks this version. The package's postinstall.js imports child_process and references HTTP GET calls and hostname lookups during the install li...

OpenSSF/OSV malware advisory MAL-2026-5640 blocks this version. The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script she...

OpenSSF/OSV malware advisory MAL-2026-6543 blocks this version. package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's m...

OpenSSF/OSV malware advisory MAL-2026-5688 blocks this version. On `npm install`, postinstall.js executes unconditionally and performs three installer-harming actions. (1) It enumerates e...

OpenSSF/OSV malware advisory MAL-2026-5846 blocks this version. Package name 'prettier_v2' closely resembles the widely-used 'prettier' formatter package, raising typosquat concerns. The...

OpenSSF/OSV malware advisory MAL-2026-5627 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5845 blocks this version. Package name 'prettier_v1' closely resembles the widely-used 'prettier' formatter package, a classic typosquat naming patte...

OpenSSF/OSV malware advisory MAL-2026-5842 blocks this version. lib/mirror.js line 13 contains a Buffer.from(..., "base64").toString("utf8") pattern. This decoding primitive is common in...

OpenSSF/OSV malware advisory MAL-2026-5842 blocks this version. lib/mirror.js line 13 contains a Buffer.from(..., "base64").toString("utf8") pattern. This decoding primitive is common in...

OpenSSF/OSV malware advisory MAL-2026-5348 blocks this version. The package ships a minified file at dist/payload.js where multiple HTTP POST call sites appear (lines 14503, 14532, 14716,...

OpenSSF/OSV malware advisory MAL-2026-5568 blocks this version. The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinst...

OpenSSF/OSV malware advisory MAL-2026-5882 blocks this version. Package is published as `redis-type-os` but all in-package references (README, docs/, CHANGELOG, repository field, author e...

OpenSSF/OSV malware advisory MAL-2026-5882 blocks this version. Package is published as `redis-type-os` but all in-package references (README, docs/, CHANGELOG, repository field, author e...

OpenSSF/OSV malware advisory MAL-2026-7314 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-7030 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code