npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15624 blocks this version. claude-channel-telegram@9.9.9 is a dependency-confusion lure with no functional code. package.json wires both preinstall a...

OpenSSF/OSV malware advisory MAL-2026-15557 blocks this version. On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/atta...

OpenSSF/OSV malware advisory MAL-2026-15557 blocks this version. On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/atta...

OpenSSF/OSV malware advisory MAL-2026-15633 blocks this version. The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions aga...

OpenSSF/OSV malware advisory MAL-2026-15568 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14565 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14560 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15564 blocks this version. package.json declares a preinstall hook that runs `node resources.js`, which fires automatically on `npm install`. resourc...

OpenSSF/OSV malware advisory MAL-2026-14579 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15568 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14541 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14518 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14511 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14564 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14564 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14564 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-15576 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships a.vscode/tasks.json with runOn=fold...