npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6574 blocks this version. yandex-geobase@3.9.0 squats the internal-sounding name 'yandex-geobase' and ships a postinstall script that performs an HTT...

OpenSSF/OSV malware advisory MAL-2026-6920 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6710 blocks this version. The package's postinstall script (`node lib/utils/index.js`) spawns a detached, stdio-suppressed Node child process that ru...

OpenSSF/OSV malware advisory MAL-2026-6918 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

OpenSSF/OSV malware advisory MAL-2026-6951 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5188 blocks this version. package.json declares a postinstall script that, on npm install, (1) enumerates process.env plus os.hostname(), os.platform...

OpenSSF/OSV malware advisory MAL-2026-6689 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dro...

OpenSSF/OSV malware advisory MAL-2026-6689 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dro...

OpenSSF/OSV malware advisory MAL-2026-6689 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dro...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...

OpenSSF/OSV malware advisory MAL-2026-6688 blocks this version. Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `console-fmt-cli` uses a side-lo...