npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13367 blocks this version. The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and rel...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-13370 blocks this version. On npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...