orderbook-volt-plugin@0.0.2
OpenSSF/OSV Malicious Advisory
imported 6d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18393 confirms this npm version as malicious.
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected manifest declares an active postinstall hook, but its target and the declared runtime entrypoints are missing from the snapshot. Their behavior cannot be resolved from the available source, so manual review is warranted.
Independent scan evidence
public snapshot- The manifest runs scripts/setup.js during postinstall, but that file is absent from the inspected snapshot.
- The manifest declares dist as a package file, but the snapshot contains no dist directory or runtime entrypoint.
Source & flagged code
3 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe manifest runs scripts/setup.js during postinstall, but that file is absent from the inspected snapshot.
package.jsonView on unpkg · L20The manifest declares dist as a package file, but the snapshot contains no dist directory or runtime entrypoint.
package.jsonView on unpkg · L9Findings
Affected versions and remediation
This report applies to orderbook-volt-plugin@0.0.2.
See all versions of orderbook-volt-plugin for other recorded verdicts.
- Avoid installing orderbook-volt-plugin@0.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.