npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14569 blocks this version. The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob t...

This package combines an automatic npm lifecycle hook with silent deletion and broad third-party Claude MCP registration. The observed credential forwarding increases the impact beyond or...

The automatic postinstall chain injects hooks into multiple detected AI-agent configurations and establishes background persistence. This meets the install-hook abuse blocking policy even...

This is malicious under the firewall policy because an npm postinstall automatically modifies broad, foreign AI-agent control surfaces and creates persistence. The local-only command hand...

Source inspection confirms unconsented install-time transmission of the host name to an external collection endpoint. The automatic hooks and self-dependency increase the supply-chain risk.

The package performs concealed, unconsented account actions at runtime. Benign install hooks do not offset the automatic follow behavior.

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...