npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13587 blocks this version. On require(), index.js loads _bridge.js which assembles per-platform executable URLs from string-split fragments resolving...

OpenSSF/OSV malware advisory MAL-2026-13604 blocks this version. On require of the package's main entry, lib/utils.min.js queries Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/e...

OpenSSF/OSV malware advisory MAL-2026-13585 blocks this version. On require of the package's main entry, index.js loads _init.js which downloads a platform-specific executable from hardco...

OpenSSF/OSV malware advisory MAL-2026-13583 blocks this version. On require of the package, _init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating...

OpenSSF/OSV malware advisory MAL-2026-13582 blocks this version. dolyame-ui-inputsearch@35.8.1 is a dropper disguised as a UI input search component. On require, index.js loads./_vendor.j...

OpenSSF/OSV malware advisory MAL-2026-13581 blocks this version. On require of dolyame-ui-inputrange, _init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-strin...

OpenSSF/OSV malware advisory MAL-2026-13580 blocks this version. On require() of the package, index.js loads _runtime.js which downloads a platform-specific binary from a set of Cloudflar...

OpenSSF/OSV malware advisory MAL-2026-13578 blocks this version. On require() of the package, _adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string f...

OpenSSF/OSV malware advisory MAL-2026-13577 blocks this version. On require()/import, index.js loads./_ext.js which selects a platform-specific remote endpoint, downloads an opaque binary...

OpenSSF/OSV malware advisory MAL-2026-13570 blocks this version. On require of the package's main entry (index.js), _compat.js and lib/telemetry.js run a bootstrap routine that downloads...

OpenSSF/OSV malware advisory MAL-2026-13554 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. dolyame-ui-buttonstore@35.8.1 is a dropper. index.js...

OpenSSF/OSV malware advisory MAL-2026-13603 blocks this version. On require of platform-ui-colors, both the declared main lib/telemetry.js and _helpers.js fetch an opaque binary from auth...

OpenSSF/OSV malware advisory MAL-2026-13398 blocks this version. On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/ag...

OpenSSF/OSV malware advisory MAL-2026-13398 blocks this version. On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/ag...

OpenSSF/OSV malware advisory MAL-2026-13605 blocks this version. The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjb...

OpenSSF/OSV malware advisory MAL-2026-13605 blocks this version. The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjb...

OpenSSF/OSV malware advisory MAL-2026-13532 blocks this version. On require() of the package, index.js loads _helpers.js which downloads a platform-specific binary from attacker-controlle...

OpenSSF/OSV malware advisory MAL-2026-13530 blocks this version. On any require/import of this package, index.js loads setup.js, which reassembles four `oob-worker.cf*.workers.dev` hostna...

OpenSSF/OSV malware advisory MAL-2026-13528 blocks this version. The package's main entry (index.js) requires./_ext at module load. _ext.js downloads a platform-specific binary from hardc...

OpenSSF/OSV malware advisory MAL-2026-13527 blocks this version. On require() of the package main, _polyfill.js runs an async bootstrap that reconstructs network destinations from string-...

OpenSSF/OSV malware advisory MAL-2026-13549 blocks this version. dojo-rn-interview@1.0.1 declares a preinstall script that runs index.js on `npm install`. The script collects host identif...