npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14474 blocks this version. LPM AI assessed this version as clean; the assessments disagree. On `npm install`, ecobee-api runs `node beacon.js` via it...

OpenSSF/OSV malware advisory MAL-2026-14139 blocks this version. The package declares `preinstall: "node index.js"`, which fires automatically on `npm install`. index.js collects host ide...

OpenSSF/OSV malware advisory MAL-2026-14138 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-13922 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home di...

OpenSSF/OSV malware advisory MAL-2026-12794 blocks this version. The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home d...

OpenSSF/OSV malware advisory MAL-2026-16046 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-12809 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-11137 blocks this version. The package's preinstall hook runs index.js which fires automatically on `npm install`. The script collects host reconnais...

OpenSSF/OSV malware advisory MAL-2026-12790 blocks this version. package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current...

OpenSSF/OSV malware advisory MAL-2026-12816 blocks this version. package.json declares a preinstall hook that runs index.js during `npm install`. The script reads /etc/passwd, /etc/hosts,...

OpenSSF/OSV malware advisory MAL-2026-12400 blocks this version. The package's preinstall script (`node index.js`) auto-executes on `npm install` and collects host identifiers (os.hostnam...

OpenSSF/OSV malware advisory MAL-2026-12392 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects the installer's hostname, u...

OpenSSF/OSV malware advisory MAL-2026-12795 blocks this version. The package's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, package path,...

OpenSSF/OSV malware advisory MAL-2026-12040 blocks this version. On `npm install`, the package's preinstall script (index.js) collects installer-side system data — os.hostname(), os.userI...

OpenSSF/OSV malware advisory MAL-2026-11152 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host identifiers (os.hostna...

OpenSSF/OSV malware advisory MAL-2026-12482 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host identifiers (os.hostna...

OpenSSF/OSV malware advisory MAL-2026-15890 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-11153 blocks this version. package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo()...

OpenSSF/OSV malware advisory MAL-2026-12813 blocks this version. On npm install, the package's postinstall script executes index.js, which collects host identifiers (os.hostname(), os.use...

OpenSSF/OSV malware advisory MAL-2026-6371 blocks this version. On `npm install`, the package's `preinstall` lifecycle hook runs `node index.js`, which collects host identity (`os.hostnam...