npm security reports, with evidence.

The automatic postinstall performs persistent writes to the user's global Claude Code configuration and injects behavior-bearing instructions. This meets the install-control-surface block...

The automatic postinstall path mutates broad AI-agent configuration and installs executable hooks. This is concrete unconsented install-hook abuse under the stated policy.

OpenSSF/OSV malware advisory MAL-2026-16100 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On require of the package, lib/cache.js (reached fro...

OpenSSF/OSV malware advisory MAL-2026-16100 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On require of the package, lib/cache.js (reached fro...

OpenSSF/OSV malware advisory MAL-2026-16100 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On require of the package, lib/cache.js (reached fro...

OpenSSF/OSV malware advisory MAL-2026-16102 blocks this version. package.json declares its only runtime dependency as an unpinned GitHub ref (`"node-net-pool": "github:trktgq0wbre1/node-n...

OpenSSF/OSV malware advisory MAL-2026-16101 blocks this version. The package presents itself as a Discord MFA helper, but its cache module contains a _warmSession routine that decodes a b...

OpenSSF/OSV malware advisory MAL-2026-15630 blocks this version. lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the...

OpenSSF/OSV malware advisory MAL-2026-16084 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16084 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16068 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16084 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16067 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16067 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16067 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16068 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16068 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16066 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-16066 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16096 blocks this version. postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks...

OpenSSF/OSV malware advisory MAL-2026-16094 blocks this version. postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys...