npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6727 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5163 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5879 blocks this version. `ioredis-os` appends `-os` to the widely-used `ioredis` package name and ships what appears to be a verbatim fork of ioredi...

OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...

OpenSSF/OSV malware advisory MAL-2026-6113 blocks this version. intquery@1.1.5 is published under the name 'intquery' by 'Stagnation Lab', but its README is a verbatim copy of the unrelat...

OpenSSF/OSV malware advisory MAL-2026-5396 blocks this version. The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single...

OpenSSF/OSV malware advisory MAL-2026-5343 blocks this version. `progerss-cli` is a typosquat of the popular `cli-progress` package that ships an obfuscated payload executed automatically...

OpenSSF/OSV malware advisory MAL-2026-5342 blocks this version. `kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload exe...

OpenSSF/OSV malware advisory MAL-2026-5883 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5394 blocks this version. @sql-access/nodesql@1.1.3 is a decoy package whose identity, README, and code do not match. The package name and keywords a...

OpenSSF/OSV malware advisory MAL-2026-5342 blocks this version. `kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload exe...

OpenSSF/OSV malware advisory MAL-2026-6113 blocks this version. intquery@1.1.5 is published under the name 'intquery' by 'Stagnation Lab', but its README is a verbatim copy of the unrelat...

OpenSSF/OSV malware advisory MAL-2026-5163 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5307 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5163 blocks this version. Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency e...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5186 blocks this version. The package ships a bundled CLI (dist/cli.cjs and dist/cli.js) in which base64 decoding primitives (Buffer.from(..., 'base6...

OpenSSF/OSV malware advisory MAL-2026-5342 blocks this version. `kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload exe...

OpenSSF/OSV malware advisory MAL-2026-5342 blocks this version. `kecak256` is a typosquat of the popular `keccak256` package (one `c` dropped) that ships a credential-stealing payload exe...