npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14551 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14551 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14551 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14551 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

The source establishes an automatic postinstall chain that removes user-wide Codex registrations and persists further install-time execution in consumer projects. This meets the install-h...

The automatic lifecycle hook executes mutable remote code and performs hook registration without a separate user setup action. This meets the install-time AI-agent control-surface abuse b...

This is a concrete unconsented postinstall mutation of multiple foreign and broad AI-agent control surfaces, plus consumer-project mutation. The lifecycle behavior meets the publish-block...

The source implements a concealed, remote-controlled action that changes a connected user's WhatsApp account state automatically. Its lifecycle hooks are benign, but the runtime subscript...

This package performs unconsented sensitive-file collection and disclosure during an automatic install hook. The absence of a real network request limits the observed scope but does not m...

The package performs concrete credential collection and transmission automatically after pairing, without a separate user confirmation. Its benign postinstall message does not mitigate th...

The package contains concrete credential exfiltration to an unrelated fixed host and automatic consumer-project dependency installation enabled by default. These behaviors are reachable t...

OpenSSF/OSV malware advisory MAL-2026-15866 blocks this version. package.json at line 14 declares a runtime dependency `microfrontend` whose source is a bare HTTPS URL (`https://repo.arti...

OpenSSF/OSV malware advisory MAL-2026-15867 blocks this version. package.json declares a dependency whose key equals the package's own name (@bx-ui-framework/common) and whose value is a...

OpenSSF/OSV malware advisory MAL-2026-15868 blocks this version. package.json declares a runtime dependency `microfrontend` whose source is a bare HTTPS URL at `https://repo.artifactoryma...

The package uses an automatic postinstall to alter consumer-project and AI-agent configuration, then deliberately persists those changes after installation. This is concrete install-hook...

OpenSSF/OSV malware advisory MAL-2026-15671 blocks this version. On npm install, the package's preinstall hook (package.json scripts.preinstall = `node index.js`) executes index.js, which...

This release has a concrete, unconsented postinstall path that mutates a broad OpenCode AI-agent control surface and causes the package to be loaded. The package-aligned Google endpoints...

OpenSSF/OSV malware advisory MAL-2026-15645 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kisama-js@0.4.8 ships an obfuscated index.js that ru...

OpenSSF/OSV malware advisory MAL-2026-15835 blocks this version. The package presents itself as a Tailwind CSS color/service-worker helper, but the `daisypick/plugin` export reads a URL f...

OpenSSF/OSV malware advisory MAL-2026-15674 blocks this version. This package presents itself as a "System binary configuration tool" — that is its entire manifest description, with keywo...