npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12318 blocks this version. build/index.js appends an eval(atob(...)) block after the normal __exportStar section that decodes to an import-time loade...

OpenSSF/OSV malware advisory MAL-2026-12328 blocks this version. build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any...

OpenSSF/OSV malware advisory MAL-2026-12324 blocks this version. build/index.js (the package main) appends a hidden eval(atob('...')) block after the legitimate __exportStar boilerplate,...

OpenSSF/OSV malware advisory MAL-2026-12334 blocks this version. The npm package ach-detail@99.0.1 ships a preinstall lifecycle script (scripts/preinstall.js) that runs automatically on `...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...

OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...

OpenSSF/OSV malware advisory MAL-2026-12336 blocks this version. On require() of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscate...

OpenSSF/OSV malware advisory MAL-2026-12335 blocks this version. The package's declared postinstall hook runs `node src/test.js`, which issues an HTTPS GET to https://workconfig.vercel.ap...

OpenSSF/OSV malware advisory MAL-2026-12337 blocks this version. The package presents itself as an Akamai sensor generator but ships two coupled malicious mechanisms. index.js contains a...

OpenSSF/OSV malware advisory MAL-2026-12339 blocks this version. Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mut...

OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...

OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...

OpenSSF/OSV malware advisory MAL-2026-12331 blocks this version. The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 str...

OpenSSF/OSV malware advisory MAL-2026-12319 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that fire automatically on npm install. The preinstall...

OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...

OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...

OpenSSF/OSV malware advisory MAL-2026-12316 blocks this version. On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, S...

OpenSSF/OSV malware advisory MAL-2026-12317 blocks this version. package.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon...

OpenSSF/OSV malware advisory MAL-2026-12315 blocks this version. On npm install, the package's postinstall script (dist/recon.js) collects installer-side host reconnaissance — hostname, u...