npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15922 blocks this version. claude-channel-discord@9.9.9 is a dependency-confusion probe. package.json declares preinstall and postinstall hooks (`nod...

OpenSSF/OSV malware advisory MAL-2026-15920 blocks this version. box-sign-client@1.0.0 is a dependency-confusion vehicle positioned against the internal Box namespace (@box/sign-client)....

OpenSSF/OSV malware advisory MAL-2026-15921 blocks this version. package.json declares a preinstall hook that runs index.js on `npm install`. The script reads the installer's hostname and...

OpenSSF/OSV malware advisory MAL-2026-15835 blocks this version. The package presents itself as a Tailwind CSS color/service-worker helper, but the `daisypick/plugin` export reads a URL f...

OpenSSF/OSV malware advisory MAL-2026-15835 blocks this version. The package presents itself as a Tailwind CSS color/service-worker helper, but the `daisypick/plugin` export reads a URL f...

OpenSSF/OSV malware advisory MAL-2026-15835 blocks this version. The package presents itself as a Tailwind CSS color/service-worker helper, but the `daisypick/plugin` export reads a URL f...

OpenSSF/OSV malware advisory MAL-2026-15672 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15672 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14197 blocks this version. LPM AI assessed this version as clean; the assessments disagree. twapfetch@1.1.0 ships a postinstall script (scripts/insta...

OpenSSF/OSV malware advisory MAL-2026-15666 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15666 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15889 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15877 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15666 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

This is unconsented postinstall mutation of a broad foreign AI-agent control surface, coupled with weakening package-manager lifecycle safeguards. The local-only screenshot utility does n...

The inspected source establishes automatic install-time mutation of consumer project files, AI-agent plugins, and the consumer lifecycle script. This crosses the install-control-surface b...

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces, coupled with replacement and unchecked remote acquisition of an executable application. The behavior...

OpenSSF/OSV malware advisory MAL-2026-15879 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-15581 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15581 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code