npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15664 blocks this version. At npm install time, @yane88/workbuddy@1.0.1's postinstall script pulls three sibling npm packages (@yane88/workbuddy-01,...

OpenSSF/OSV malware advisory MAL-2026-15689 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares a dependency `lil-swisgom-hlep...

OpenSSF/OSV malware advisory MAL-2026-15854 blocks this version. The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-s...

OpenSSF/OSV malware advisory MAL-2026-15851 blocks this version. The package's preinstall lifecycle script iterates process.env and filters keys for credential-shaped substrings (key, sec...

OpenSSF/OSV malware advisory MAL-2026-15856 blocks this version. The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions....

OpenSSF/OSV malware advisory MAL-2026-15855 blocks this version. The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list...

OpenSSF/OSV malware advisory MAL-2026-15852 blocks this version. @quantixfinance/sdk@1.0.0 ships an inert library body (index.js exports an empty QuantixSDK class and a createClient stub)...

OpenSSF/OSV malware advisory MAL-2026-15853 blocks this version. The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-s...

OpenSSF/OSV malware advisory MAL-2026-15857 blocks this version. The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall l...

OpenSSF/OSV malware advisory MAL-2026-15849 blocks this version. The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list o...

OpenSSF/OSV malware advisory MAL-2026-15850 blocks this version. The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list...

OpenSSF/OSV malware advisory MAL-2026-15848 blocks this version. The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every va...

OpenSSF/OSV malware advisory MAL-2026-15847 blocks this version. package.json declares preinstall and install lifecycle scripts that collect the installer's username (whoami), hostname, c...

OpenSSF/OSV malware advisory MAL-2026-14567 blocks this version. index.js re-exports the legitimate tailwindcss-3d plugin and then appends `eval(atob("..."))` at module top level, so the...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships a.vscode/tasks.json with runOn=fold...

OpenSSF/OSV malware advisory MAL-2026-14567 blocks this version. LPM AI assessed this version as clean; the assessments disagree. index.js re-exports the legitimate tailwindcss-3d plugin...

OpenSSF/OSV malware advisory MAL-2026-3081 blocks this version. The package frank-research-poc-apple was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3080 blocks this version. The package frank-bot-gogle-cloning was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-15825 blocks this version. package.json declares a preinstall script that runs an inline node command reading the installer's OS hostname, username,...

OpenSSF/OSV malware advisory MAL-2026-15822 blocks this version. The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encode...