numbors@1.6.1
OpenSSF/OSV Malicious Advisory
imported 10d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18322 confirms this npm version as malicious.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The CLI entrypoint reaches an obfuscated runtime, and inspection did not resolve its behavior. No concrete attack was established, so the package requires manual review.
Independent scan evidence
public snapshot- package.json exposes bin/cli.js, which loads dist/main; the runtime bundles contain encoded string tables and computed property lookups.
- The inspected source does not resolve the behavior behind those obfuscated runtime operations, so no attack is confirmed and safety remains undetermined.
Source & flagged code
7 flaggedpackage.json exposes bin/cli.js, which loads dist/main; the runtime bundles contain encoded string tables and computed property lookups.
bin/cli.jsView on unpkg · L1Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L2Source contains an obfuscated payload loader that reconstructs and executes hidden code.
Findings
Affected versions and remediation
This report applies to numbors@1.6.1.
See all versions of numbors for other recorded verdicts.
- Avoid installing numbors@1.6.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.