npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-16071 blocks this version. cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0....

OpenSSF/OSV malware advisory MAL-2026-16071 blocks this version. cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0....

OpenSSF/OSV malware advisory MAL-2026-16072 blocks this version. The package's preinstall lifecycle script (preinstall.js) executes automatically on `npm install` and collects the install...

OpenSSF/OSV malware advisory MAL-2026-16073 blocks this version. The package ships an empty library body (index.js exports {}) and a preinstall lifecycle script that runs automatically on...

OpenSSF/OSV malware advisory MAL-2026-16074 blocks this version. The package's preinstall lifecycle script runs automatically on `npm install` and collects installer-side identifiers — `o...

OpenSSF/OSV malware advisory MAL-2026-16075 blocks this version. easypanel-hosting@1.0.0 ships a stub index.js (`module.exports = {}`) and an npm preinstall lifecycle script that collects...

OpenSSF/OSV malware advisory MAL-2026-16076 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares dependencies and optionalDepen...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...

OpenSSF/OSV malware advisory MAL-2026-15989 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14537 blocks this version. The package declares a preinstall lifecycle script (`node index.js`) that runs automatically on `npm install`. index.js co...

OpenSSF/OSV malware advisory MAL-2026-16033 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16033 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-16035 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16035 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16035 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16035 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16036 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16004 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-16035 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14434 blocks this version. The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS server...