npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6684 blocks this version. postcss-property-rollup@0.0.1 was scanned with no a static rule matches and no behavioral findings. No exfiltration, instal...

OpenSSF/OSV malware advisory MAL-2026-6682 blocks this version. Analysis of this package version produced no static indicator and no traced behavioral findings. The tarball does not exhib...

OpenSSF/OSV malware advisory MAL-2026-6686 blocks this version. Package setup-cicd@0.0.1 contains no observed behaviors matching supply-chain attack patterns. No lifecycle scripts, instal...

OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...

OpenSSF/OSV malware advisory MAL-2026-6940 blocks this version. No a static rule matches and no behavioral findings were produced for this package version. There is no evidence of credent...

OpenSSF/OSV malware advisory MAL-2026-6550 blocks this version. Package claims the @k18n npm scope (used internally by Kuaishou) and publishes at version 99.0.0 — the canonical high-versi...

OpenSSF/OSV malware advisory MAL-2026-6550 blocks this version. Package claims the @k18n npm scope (used internally by Kuaishou) and publishes at version 99.0.0 — the canonical high-versi...

OpenSSF/OSV malware advisory MAL-2026-6550 blocks this version. Package claims the @k18n npm scope (used internally by Kuaishou) and publishes at version 99.0.0 — the canonical high-versi...

OpenSSF/OSV malware advisory MAL-2026-6996 blocks this version. package.json declares a preinstall script that runs `npm install @sentry/node && node examples/verify.js`. examples/verify....

OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...

OpenSSF/OSV malware advisory MAL-2026-6413 blocks this version. Package contains no observed installer-side harmful behavior. No exfiltration, no install-time fetch-and-execute, no silent...

OpenSSF/OSV malware advisory MAL-2026-6517 blocks this version. All published JavaScript in dist/ (index.js, client.js, server.js, react.js, and sibling chunks) is heavily obfuscated usin...

OpenSSF/OSV malware advisory MAL-2026-6410 blocks this version. Package self-identifies as a dependency-confusion bug-bounty proof-of-concept and is published at version 99.99.99 to win r...

OpenSSF/OSV malware advisory MAL-2026-6408 blocks this version. Package self-identifies as a HubSpot dependency-confusion proof-of-concept and is published at version 99.99.99 — a typical...

OpenSSF/OSV malware advisory MAL-2026-6396 blocks this version. signup-embedder@99.99.99-poc2 ships preinstall.js and postinstall.js lifecycle scripts that auto-execute on `npm install`....

OpenSSF/OSV malware advisory MAL-2026-6412 blocks this version. Package self-describes as a security PoC for dependency confusion targeting an internal HubSpot module name. On install, po...

OpenSSF/OSV malware advisory MAL-2026-6411 blocks this version. Package self-identifies in its package.json description as a bug-bounty dependency-confusion proof-of-concept against an in...

OpenSSF/OSV malware advisory MAL-2026-6414 blocks this version. Package self-identifies as a dependency-confusion proof-of-concept aimed at an internal/private package name. The postinsta...

OpenSSF/OSV malware advisory MAL-2026-6394 blocks this version. Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal `hs-locale-...

OpenSSF/OSV malware advisory MAL-2026-6407 blocks this version. Package is openly labeled a dependency-confusion proof-of-concept and uses a high version number (99.99.99) consistent with...

OpenSSF/OSV malware advisory MAL-2024-1006 blocks this version. @ebay/ui-core-react@9.8.1 is a scoped React UI component library published under the eBay organization scope. No indicators...