npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15644 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15644 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15582 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15582 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15843 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-15878 blocks this version. The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a ~41KB base64-enc...

OpenSSF/OSV malware advisory MAL-2026-15878 blocks this version. The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a ~41KB base64-enc...

OpenSSF/OSV malware advisory MAL-2026-15491 blocks this version. index.js contains an IIFE that fires on require() and walks the installer's home and project directories collecting.env* f...

OpenSSF/OSV malware advisory MAL-2026-15491 blocks this version. index.js contains an IIFE that fires on require() and walks the installer's home and project directories collecting.env* f...

OpenSSF/OSV malware advisory MAL-2026-14557 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15832 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14533 blocks this version. On require('chai-plus'), a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute(), which spawns `npm i...

OpenSSF/OSV malware advisory MAL-2026-14533 blocks this version. On require('chai-plus'), a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute(), which spawns `npm i...

OpenSSF/OSV malware advisory MAL-2026-15490 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15490 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15489 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15880 blocks this version. Package is published as an element-ui utility library (`element-guci-util`, description '元素-ui 常用工具函数集合') but its main ent...

OpenSSF/OSV malware advisory MAL-2026-14506 blocks this version. LPM AI assessed this version as clean; the assessments disagree. The package was found to contain malicious code or consum...

OpenSSF/OSV malware advisory MAL-2026-15831 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15832 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...