npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13347 blocks this version. javas-crypto ships a postinstall hook (package.json line 11: "postinstall": "node setup.js") and a top-level autoExecute()...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

This is a concrete import-time staged-payload execution chain unrelated to the declared template interface. The absence of lifecycle hooks does not mitigate execution on normal package use.

OpenSSF/OSV malware advisory MAL-2026-13357 blocks this version. On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesti...

The benign exported API is a wrapper around automatic import-time remote binary execution. This is concrete malware behavior, not telemetry or a user-invoked optional setup path.

OpenSSF/OSV malware advisory MAL-2026-13209 blocks this version. The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespok...

OpenSSF/OSV malware advisory MAL-2026-13210 blocks this version. The package's package.json declares its dependency "@openai/codex" as a direct tarball URL: https://gitcode.com/api/v5/rep...

OpenSSF/OSV malware advisory MAL-2026-13217 blocks this version. akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode var...

OpenSSF/OSV malware advisory MAL-2026-13216 blocks this version. The package hides an executable payload inside a block comment in index.js using Unicode variation selectors (U+FE00–U+FE0...

OpenSSF/OSV malware advisory MAL-2026-13175 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On require('dolyame-ui-popup'), index.js loads _help...

This is a concrete import-time staged-payload execution chain unrelated to the package's stated UI themes purpose. The lack of lifecycle hooks does not mitigate execution on ordinary import.

OpenSSF/OSV malware advisory MAL-2026-13122 blocks this version. On require('bpm-ng-security'), index.js loads _bridge.js whose top-level bootstrap fetches a platform-specific binary from...

OpenSSF/OSV malware advisory MAL-2026-13121 blocks this version. On require() of the package, index.js loads _bridge.js, which reconstructs Cloudflare Workers hostnames from split string...

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

The import-time loader has no legitimate package functionality connection and concretely downloads and executes remote native payloads. This is malicious despite the absence of npm lifecy...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

OpenSSF/OSV malware advisory MAL-2026-12767 blocks this version. On require of the package, index.js loads _bridge.js, which assembles platform-specific destination hostnames via string-s...

OpenSSF/OSV malware advisory MAL-2026-12768 blocks this version. index.js unconditionally requires./_loader on load. _loader.js reassembles Cloudflare workers.dev hostnames (oob-worker.cf...