npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6953 blocks this version. The package declares a postinstall script (`node index.js`) that runs unconditionally on `npm install`. The script POSTs th...

OpenSSF/OSV malware advisory MAL-2026-6950 blocks this version. The package's `postinstall` script runs `node index.js` on install, which invokes `reportLoadedFrom` to POST installer-side...

OpenSSF/OSV malware advisory MAL-2026-6950 blocks this version. The package's `postinstall` script runs `node index.js` on install, which invokes `reportLoadedFrom` to POST installer-side...

OpenSSF/OSV malware advisory MAL-2026-6919 blocks this version. Package impersonates the pino logger (exports module.exports.pino, README uses pino badge, keywords mimic pino) but its act...

OpenSSF/OSV malware advisory MAL-2026-6797 blocks this version. On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GE...

OpenSSF/OSV malware advisory MAL-2026-10078 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares a postinstall lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-10079 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares a postinstall lifecycle script...

OpenSSF/OSV malware advisory MAL-2026-6994 blocks this version. On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's `cookie` field t...

OpenSSF/OSV malware advisory MAL-2026-6994 blocks this version. On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's `cookie` field t...

OpenSSF/OSV malware advisory MAL-2026-6932 blocks this version. On require, index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK, passes the returned JSON `cookie` field to...

OpenSSF/OSV malware advisory MAL-2026-6943 blocks this version. tx-guard-snap advertises itself as a real-time transaction security analysis MetaMask Snap but performs no analysis. Its on...

OpenSSF/OSV malware advisory MAL-2026-6404 blocks this version. Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay...

OpenSSF/OSV malware advisory MAL-2026-6797 blocks this version. On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GE...

OpenSSF/OSV malware advisory MAL-2026-6923 blocks this version. The package presents itself as a pino-compatible logger (README, keywords, and a `module.exports.pino` alias mirror the pin...

OpenSSF/OSV malware advisory MAL-2026-6919 blocks this version. Package impersonates the pino logger (exports module.exports.pino, README uses pino badge, keywords mimic pino) but its act...

OpenSSF/OSV malware advisory MAL-2026-10065 blocks this version. Package is published as `nodemon-gulp` but its contents are a verbatim copy of the upstream `nodemon` project: `package.js...

OpenSSF/OSV malware advisory MAL-2026-5994 blocks this version. The package impersonates the pino logger (README titled 'chai-mocks', badges linking to pinojs/pino, module export named `p...

OpenSSF/OSV malware advisory MAL-2026-10061 blocks this version. The package has no legitimate functionality (index.js is an empty module) and exists solely to run an install-time attack...

OpenSSF/OSV malware advisory MAL-2026-10043 blocks this version. Package name is a 1-2 character variant of the widely-used `chai-as-promised` plugin. The exported function — the entry po...

OpenSSF/OSV malware advisory MAL-2026-10056 blocks this version. The package presents itself as a pino-compatible logger (exports `pino`, mirrors pino's lib/ layout with proto.js/redactio...