npm security reports, with evidence.

The automatic lifecycle hook performs privileged system package installation and destructive dependency rebuild actions, then preserves a runtime path that repeats them. These actions exc...

The package automatically sends telemetry containing identity and command activity to a fixed unrelated endpoint at runtime. No install hook is needed for this concrete data-exfiltration...

OpenSSF/OSV malware advisory MAL-2026-16042 blocks this version. package.json declares a preinstall script (preinstall.js) that runs automatically on `npm install`. The script collects os...

OpenSSF/OSV malware advisory MAL-2026-15997 blocks this version. The package impersonates the legitimate blakeembrey/node-helper library (matching author metadata, README, MIT license, an...

OpenSSF/OSV malware advisory MAL-2026-15969 blocks this version. The npm package array-frames@2.3.6 advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload...

OpenSSF/OSV malware advisory MAL-2026-15997 blocks this version. The package impersonates the legitimate blakeembrey/node-helper library (matching author metadata, README, MIT license, an...

OpenSSF/OSV malware advisory MAL-2026-15969 blocks this version. The npm package array-frames@2.3.6 advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload...

OpenSSF/OSV malware advisory MAL-2026-15991 blocks this version. The package is published as a trivial JWT logging helper but its main module (jwt-logger.js) is a heavily obfuscated strin...

OpenSSF/OSV malware advisory MAL-2026-15991 blocks this version. The package is published as a trivial JWT logging helper but its main module (jwt-logger.js) is a heavily obfuscated strin...

OpenSSF/OSV malware advisory MAL-2026-15991 blocks this version. The package is published as a trivial JWT logging helper but its main module (jwt-logger.js) is a heavily obfuscated strin...

The package has a concrete automatic install-time chain that broadly mutates foreign AI-agent control surfaces. This meets the install-hook abuse blocking boundary even though no credenti...

OpenSSF/OSV malware advisory MAL-2026-16048 blocks this version. The package presents itself as a console shim (index.js is a verbatim copy of console-browserify with description 'Emulate...

OpenSSF/OSV malware advisory MAL-2026-16048 blocks this version. The package presents itself as a console shim (index.js is a verbatim copy of console-browserify with description 'Emulate...

OpenSSF/OSV malware advisory MAL-2026-16049 blocks this version. src/index.js, referenced by the package main and executed on require(), performs an HTTP GET to http://tailwindlan.online,...

OpenSSF/OSV malware advisory MAL-2026-16049 blocks this version. src/index.js, referenced by the package main and executed on require(), performs an HTTP GET to http://tailwindlan.online,...

OpenSSF/OSV malware advisory MAL-2026-16009 blocks this version. This package is malicious. It is not a real library. An attacker put it on the public npm registry. The package name is a...

OpenSSF/OSV malware advisory MAL-2026-15941 blocks this version. Package name resembles an internal-scoped name and uses an implausibly high version (9999.0.0) consistent with dependency-...

OpenSSF/OSV malware advisory MAL-2026-15939 blocks this version. omni-channel-oid-frontend ships a preinstall.js lifecycle script that fires automatically on `npm install`. The script col...

OpenSSF/OSV malware advisory MAL-2026-15943 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15974 blocks this version. The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate...

OpenSSF/OSV malware advisory MAL-2026-15974 blocks this version. The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate...