npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...

OpenSSF/OSV malware advisory MAL-2026-6358 blocks this version. babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env blo...

OpenSSF/OSV malware advisory MAL-2026-6359 blocks this version. The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently execute...

OpenSSF/OSV malware advisory MAL-2026-6358 blocks this version. babel.config.cjs contains a heavily obfuscated (obfuscator.io-style) IIFE appended after a legitimate @babel/preset-env blo...

OpenSSF/OSV malware advisory MAL-2026-14504 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14505 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14503 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6223 blocks this version. The package is published as 'mjs-eslint' but its description, file layout (big.js, big.mjs), and source are a verbatim copy...

OpenSSF/OSV malware advisory MAL-2026-14549 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14549 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14549 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-6223 blocks this version. The package is published as 'mjs-eslint' but its description, file layout (big.js, big.mjs), and source are a verbatim copy...

OpenSSF/OSV malware advisory MAL-2026-14549 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14513 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5935 blocks this version. The published entrypoints dist/index.cjs and dist/runtime.cjs contain an injected IIFE that assigns `global.r = require` an...

OpenSSF/OSV malware advisory MAL-2026-14550 blocks this version. tset_racie@1.0.3 ships a single 45KB obfuscator.io-style payload as its main entry (index.js). The file consists of a 551-...

OpenSSF/OSV malware advisory MAL-2026-14550 blocks this version. tset_racie@1.0.3 ships a single 45KB obfuscator.io-style payload as its main entry (index.js). The file consists of a 551-...

OpenSSF/OSV malware advisory MAL-2026-14510 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-5714 blocks this version. On require, index.js walks up to 5 parent directories searching for `public/assets/logo.png`, scans the file bytes for the...

This package has a concrete, automatic postinstall chain that overwrites a consumer Claude skill with broad activation instructions. Under the install-control-surface policy, that is mali...