npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15678 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15678 blocks this version.

OpenSSF/OSV malware advisory MAL-2025-6396 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2025-6396 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...

OpenSSF/OSV malware advisory MAL-2026-15647 blocks this version. The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the sc...

OpenSSF/OSV malware advisory MAL-2026-15602 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships a.vscode/tasks.json with runOn=fold...

OpenSSF/OSV malware advisory MAL-2026-15631 blocks this version. The package masquerades as a Next.js updater but its exported `downloadAndRunUpdate` function fetches `updater.hta` from a...

OpenSSF/OSV malware advisory MAL-2026-15632 blocks this version. On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from https...

OpenSSF/OSV malware advisory MAL-2026-15629 blocks this version. package.json declares dependency `node-net-pool` with its value set to an arbitrary HTTPS tarball URL (`https://limbomail....

OpenSSF/OSV malware advisory MAL-2026-15628 blocks this version. lib/cache.js reconstructs a base64-fragmented URL (decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKD...

OpenSSF/OSV malware advisory MAL-2026-15630 blocks this version. lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the...

OpenSSF/OSV malware advisory MAL-2026-15587 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15637 blocks this version. The package declares a postinstall hook (`node dist/script.js`) while its declared main entry (`dist/index.js`) is an iner...

OpenSSF/OSV malware advisory MAL-2026-15638 blocks this version. On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential ma...

OpenSSF/OSV malware advisory MAL-2026-15637 blocks this version. The package declares a postinstall hook (`node dist/script.js`) while its declared main entry (`dist/index.js`) is an iner...

OpenSSF/OSV malware advisory MAL-2026-15624 blocks this version. claude-channel-telegram@9.9.9 is a dependency-confusion lure with no functional code. package.json wires both preinstall a...

OpenSSF/OSV malware advisory MAL-2026-15557 blocks this version. On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/atta...

OpenSSF/OSV malware advisory MAL-2026-15557 blocks this version. On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/atta...

OpenSSF/OSV malware advisory MAL-2026-15633 blocks this version. The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions aga...