npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2025-47594 blocks this version. The package communicates with a domain associated with malicious activity.

OpenSSF/OSV malware advisory MAL-2026-15985 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2023-1111 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs automatically on npm install. index.js re...

OpenSSF/OSV malware advisory MAL-2026-15960 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15969 blocks this version. The npm package array-frames@2.3.6 advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload...

OpenSSF/OSV malware advisory MAL-2026-15969 blocks this version. The npm package array-frames@2.3.6 advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload...

OpenSSF/OSV malware advisory MAL-2026-15969 blocks this version. The npm package array-frames@2.3.6 advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload...

OpenSSF/OSV malware advisory MAL-2026-15975 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-15960 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15960 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15960 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13972 blocks this version. package.json declares `postinstall: node beacon.js`. On every `npm install`, beacon.js unconditionally performs a DNS look...

OpenSSF/OSV malware advisory MAL-2026-13549 blocks this version. dojo-rn-interview@1.0.1 declares a preinstall script that runs index.js on `npm install`. The script collects host identif...

OpenSSF/OSV malware advisory MAL-2026-12033 blocks this version. The package's package.json declares a `preinstall: node index.js` hook that fires automatically on `npm install`. index.js...

OpenSSF/OSV malware advisory MAL-2026-12787 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, use...

OpenSSF/OSV malware advisory MAL-2026-12356 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance (os.hos...

OpenSSF/OSV malware advisory MAL-2026-15970 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15970 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15648 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-12062 blocks this version. package.json declares `preinstall: node index.js`. On `npm install`, index.js collects the installer's hostname, username,...

OpenSSF/OSV malware advisory MAL-2026-6367 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js collects insta...