Malware advisory
MAL-2026-10728
Malicious code in bvm-core (npm)
2 affected releases in the PkgRadar corpus · published 2026-07-16 · upstream advisory
Affected packages
Every release listed here is malicious per this advisory and is blocked at the CI gate. The Static scancolumn is PkgRadar’s independent static-analysis result for that release — some malicious releases score low on static signals alone, which is why we also mirror the advisory as authoritative.