npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15494 blocks this version. The tarball ships a binding.gyp at the package root whose `conditions` field abuses GYP's Python expression evaluator to w...

OpenSSF/OSV malware advisory MAL-2026-15498 blocks this version. LPM AI assessed this version as clean; the assessments disagree. package.json declares a dependency whose key equals the p...

OpenSSF/OSV malware advisory MAL-2026-15498 blocks this version. LPM AI assessed this version as clean; the assessments disagree. package.json declares a dependency whose key equals the p...

OpenSSF/OSV malware advisory MAL-2026-15520 blocks this version. package.json declares a dependency whose key equals the package's own name (ring-device-settings-library) and whose value...

OpenSSF/OSV malware advisory MAL-2026-15516 blocks this version. package.json declares its own name `nx-app` as a dependency whose value is a raw HTTPS URL (`https://repo.securityctrl.com...

OpenSSF/OSV malware advisory MAL-2026-15513 blocks this version. package.json declares a dependency whose value is a bare HTTPS URL (https://repo.securityctrl.com/katal-logger) instead of...

OpenSSF/OSV malware advisory MAL-2026-15500 blocks this version. package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero...

OpenSSF/OSV malware advisory MAL-2026-15518 blocks this version. package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-...

OpenSSF/OSV malware advisory MAL-2026-15524 blocks this version. package.json at line 11 declares a dependency whose key equals the package's own name (`tabbables`) and whose value is the...

OpenSSF/OSV malware advisory MAL-2026-15519 blocks this version. package.json line 11 declares a self-referential dependency whose source is a bare HTTP URL rather than a registry version...

OpenSSF/OSV malware advisory MAL-2026-15510 blocks this version. package.json declares the package's own name as a dependency whose source is the bare HTTPS URL https://repo.securityctrl....

OpenSSF/OSV malware advisory MAL-2026-15514 blocks this version. package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL h...

OpenSSF/OSV malware advisory MAL-2026-15515 blocks this version. package.json declares a dependency whose value is a bare HTTPS URL (https://repo.securityctrl.com/npm-extension) rather th...