npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15685 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15685 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15685 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15684 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15683 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15682 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15676 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15676 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15677 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15677 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15679 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15679 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15678 blocks this version.

OpenSSF/OSV malware advisory MAL-2026-15678 blocks this version.

The bundled runtime gives a fixed remote service control over local tools while bypassing the stated approval gate and returning tool output to that service. The empty install hook does n...

This is an install-hook supply-chain payload path: installation automatically downloads and executes a separate Python package while writing outside the package directory. The fixed versi...

This package contains a concrete automatic remote-code execution path that runs after normal CLI use without a user confirmation step. Its fixed gateway also receives the package's stored...

The active, obfuscated remote redirect mechanism has no legitimate package purpose and hides its final destination. The absence of npm lifecycle hooks limits installation impact but does...

The source establishes an automatic npm lifecycle path to host-wide package installation and service activation. This concrete install-time mutation warrants blocking even though the inst...

The package has a concrete postinstall chain that automatically writes bundled content into shared Claude and Codex agent control surfaces. This meets the install-hook abuse block conditi...