merge-grid-stats@1.5.0: Suspicious npm security report (Warn)

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13484 confirms this npm version as malicious.

Advisory

MAL-2026-13484

Source

OpenSSF Malicious Packages via OSV

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 3.82 KB of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node install-cb.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

install-cb.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = merge-grid-stats@1.4.0 matchedIdentity = npm:bWVyZ2UtZ3JpZC1zdGF0cw:1.4.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install-cb.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-cb.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

install-cb.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = merge-grid-stats@1.4.0 matchedIdentity = npm:bWVyZ2UtZ3JpZC1zdGF0cw:1.4.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install-cb.jsView on unpkg

Findings

2 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltainstall-cb.js

MediumEnvironment Vars

LowScripts Present

LowFilesystem