npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14971 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14865 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14837 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14815 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14913 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14861 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14871 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14980 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14907 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14966 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14569 blocks this version. The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob t...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...