npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15491 blocks this version. index.js contains an IIFE that fires on require() and walks the installer's home and project directories collecting.env* f...

Direct source inspection confirms an automatic install hook that executes remote code and persists it through shell profiles and cron. The benign runtime export does not mitigate this con...

This is a concrete install-time remote-code-execution and persistence chain unrelated to the package's exported utilities. The package should be blocked.

The confirmed preinstall hook performs concealed remote code execution from an unreviewable payload. The harmless-looking runtime stub does not mitigate this install-time behavior.

The package contains a confirmed automatic install-time remote-code-execution chain. Its minimal runtime code does not justify or constrain that behavior.

OpenSSF/OSV malware advisory MAL-2026-14841 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14819 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14809 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14807 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14813 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14823 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14810 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14808 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

The manifest contains a concrete automatic install-time remote payload execution and cron persistence chain. The minimal runtime module does not justify this behavior.

Source inspection confirms an automatic install hook that fetches and executes a remote payload, then establishes cron persistence. This is concrete malicious install-hook abuse.

This package performs unconsented remote code execution during preinstall and persists it through cron. This is concrete malware behavior, not a logging feature.

Direct source inspection confirms an automatic install hook that executes an unverified remote script and creates cron persistence. The benign-looking runtime stub does not mitigate this...

This is concrete unconsented install-time remote code execution with persistence. The harmless runtime stub does not mitigate the lifecycle attack.

The package performs unconsented install-time host fingerprinting and external transmission. Its empty runtime code does not justify that behavior.

The package performs unconsented install-time host reconnaissance and exfiltrates it to a fixed external endpoint. Its only runtime file is empty, leaving no package function that justifi...

The automatic SVG import, deliberate obfuscation, and dynamic code execution are incompatible with a passive SVG package. Lack of install hooks reduces install-time risk but does not remo...