npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-10094 blocks this version. package.json declares a postinstall hook (`node setup.js`) that fires automatically on `npm install`. setup.js selects a p...

OpenSSF/OSV malware advisory MAL-2026-10094 blocks this version. package.json declares a postinstall hook (`node setup.js`) that fires automatically on `npm install`. setup.js selects a p...

OpenSSF/OSV malware advisory MAL-2026-10092 blocks this version. Package `vite-pwa-config` impersonates the popular `vite-plugin-pwa` (antfu) — the README instructs users to import `confi...

OpenSSF/OSV malware advisory MAL-2026-10019 blocks this version. package.json declares postinstall=`node index.js`, which runs automatically on `npm install`. index.js collects host ident...

OpenSSF/OSV malware advisory MAL-2026-5565 blocks this version. ai-sdk-helpers@1.2.1 is a typosquat impersonating the Vercel AI SDK ecosystem (homepage ai-sdk.guide, author 'AI SDK Guide...

OpenSSF/OSV malware advisory MAL-2026-10073 blocks this version. The package presents itself as a Tailwind CSS animation plugin and reproduces the legitimate tailwindcss-animate source (i...

OpenSSF/OSV malware advisory MAL-2026-10073 blocks this version. The package presents itself as a Tailwind CSS animation plugin and reproduces the legitimate tailwindcss-animate source (i...

OpenSSF/OSV malware advisory MAL-2026-6797 blocks this version. On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GE...

OpenSSF/OSV malware advisory MAL-2026-6797 blocks this version. On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GE...

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-10082 blocks this version. The package presents itself as a pino-compatible logger (lib/ directory mirrors pino's internal file layout — proto.js, le...

OpenSSF/OSV malware advisory MAL-2026-6947 blocks this version. On `npm install`, package.json's postinstall executes dist/setup.js and dist/postinstall.js. The scripts read installer-sid...

OpenSSF/OSV malware advisory MAL-2026-10088 blocks this version. `lovable-tager` is a single-character-deletion typosquat of the legitimate Vite plugin `lovable-tagger`. The ESM entry `di...

OpenSSF/OSV malware advisory MAL-2026-10088 blocks this version. `lovable-tager` is a single-character-deletion typosquat of the legitimate Vite plugin `lovable-tagger`. The ESM entry `di...

OpenSSF/OSV malware advisory MAL-2026-6826 blocks this version. Package name mimics the rollup-plugin-* ecosystem but exposes no Rollup plugin API. Its exported functions getPlugin, setPl...

OpenSSF/OSV malware advisory MAL-2026-6964 blocks this version. package.json declares `postinstall: node index.js`, causing index.js to execute automatically on `npm install`. The script...

OpenSSF/OSV malware advisory MAL-2026-6964 blocks this version. package.json declares `postinstall: node index.js`, causing index.js to execute automatically on `npm install`. The script...

OpenSSF/OSV malware advisory MAL-2026-6964 blocks this version. package.json declares `postinstall: node index.js`, causing index.js to execute automatically on `npm install`. The script...

OpenSSF/OSV malware advisory MAL-2026-6939 blocks this version. polytrade@2.4.1 advertises itself as a Polymarket API SDK, but the exported `getPlugin` function in index.js issues an HTTP...

OpenSSF/OSV malware advisory MAL-2026-6921 blocks this version. On require('jsf-utils'), lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://...

OpenSSF/OSV malware advisory MAL-2026-6921 blocks this version. On require('jsf-utils'), lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://...