npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15880 blocks this version. Package is published as an element-ui utility library (`element-guci-util`, description '元素-ui 常用工具函数集合') but its main ent...

OpenSSF/OSV malware advisory MAL-2026-15880 blocks this version. Package is published as an element-ui utility library (`element-guci-util`, description '元素-ui 常用工具函数集合') but its main ent...

OpenSSF/OSV malware advisory MAL-2026-15880 blocks this version. Package is published as an element-ui utility library (`element-guci-util`, description '元素-ui 常用工具函数集合') but its main ent...

OpenSSF/OSV malware advisory MAL-2026-15880 blocks this version. Package is published as an element-ui utility library (`element-guci-util`, description '元素-ui 常用工具函数集合') but its main ent...

OpenSSF/OSV malware advisory MAL-2026-15880 blocks this version. Package is published as an element-ui utility library (`element-guci-util`, description '元素-ui 常用工具函数集合') but its main ent...

OpenSSF/OSV malware advisory MAL-2026-15561 blocks this version. package.json declares a preinstall hook (`node beacon.js`) that fires automatically on `npm install`. beacon.js reads os.h...

OpenSSF/OSV malware advisory MAL-2026-14553 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-15914 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The `taskforge` CLI, once configured with an origin...

OpenSSF/OSV malware advisory MAL-2026-15913 blocks this version. The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handle...

The automatic lifecycle hook broadly mutates foreign project and host AI-agent control surfaces, including enabling a host-level tool hook. This meets the install-hook abuse blocking poli...

The inspected source establishes an automatic install-time chain that mutates consumer and user AI-agent configuration. This meets the policy boundary for unconsented lifecycle control-su...

The package deliberately impersonates Node to intercept dependency lifecycle execution and performs unconsented local and browser side effects before forwarding the command. Its lack of i...

This is concrete unconsented postinstall mutation of a consumer project's AI-agent configuration, with additional user-wide Codex changes. The code does not show secret theft, but the aut...

The package contains credential-linked command telemetry and AI-tool inventory collection, concealed behind a heavily obfuscated exam command. These behaviors create a concrete data-exfil...

OpenSSF/OSV malware advisory MAL-2026-15905 blocks this version. The package's main entry point fetches a JavaScript file from http://23.27.245.100:3000/index.js over plain HTTP at requir...

OpenSSF/OSV malware advisory MAL-2026-15897 blocks this version. easypanel-core ships an inert `module.exports = {}` main and places all functionality in a preinstall lifecycle script. On...

OpenSSF/OSV malware advisory MAL-2026-15899 blocks this version. The preinstall lifecycle script collects host fingerprint data (os.hostname(), os.userInfo().username, process.cwd(), and...

OpenSSF/OSV malware advisory MAL-2026-15896 blocks this version. The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-relate...

OpenSSF/OSV malware advisory MAL-2026-15895 blocks this version. The package's preinstall lifecycle script runs automatically on npm install and collects installer identity (os.hostname()...

OpenSSF/OSV malware advisory MAL-2026-15898 blocks this version. On `npm install`, the preinstall lifecycle script collects installer host identity (hostname, username, cwd) and enumerate...

OpenSSF/OSV malware advisory MAL-2026-15901 blocks this version. The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lif...