npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

OpenSSF/OSV malware advisory MAL-2026-14578 blocks this version. The `push` subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error te...

This is concrete, unconsented runtime tampering with a foreign installed package that causes a messaging-account action. It is unrelated to the advertised libsignal functionality and is m...

OpenSSF/OSV malware advisory MAL-2026-14568 blocks this version. src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style _0...

OpenSSF/OSV malware advisory MAL-2026-14567 blocks this version. LPM AI assessed this version as clean; the assessments disagree. index.js re-exports the legitimate tailwindcss-3d plugin...

The package deliberately rewrites consumer source during postinstall and causes runtime monkey-patching through the injected import. That concrete install-time behavior warrants blocking...

This is an automatic install-time hidden-code execution chain, not normal reporter functionality. Block publication to prevent arbitrary concealed code from running during installation.

The package contains an automatic, obfuscated, undeclared dynamic-import path plus environment-gated process termination. These behaviors are unrelated to the documented SDK and create a...