npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

The package contains a concrete, hidden runtime action that mutates a user's WhatsApp account using a remotely controlled target list. This warrants blocking despite the benign Node-versi...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...