Loading npm security reports…
Security research PoC reported to Allwyn AG via HackerOne. Emits a single out-of-band callback (hostname/user/cwd/platform) to prove public-registry resolution. No credential, file or environment access.
OpenSSF/OSV advisory MAL-2026-14387 confirms this npm version as malicious. The OpenSSF Package Analysis project identified '@opap/player-kyc-widget' @ 3.999.999 (npm) as malicious.