npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15563 blocks this version. vitest-chalk-pro@10.0.7 declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child proce...

OpenSSF/OSV malware advisory MAL-2026-15552 blocks this version. On require('discord-mfa'), index.js loads lib/cache.js which, when running on Windows, downloads a JavaScript payload from...

OpenSSF/OSV malware advisory MAL-2026-15553 blocks this version. The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side...

OpenSSF/OSV malware advisory MAL-2026-15561 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares a preinstall hook (`node beaco...

OpenSSF/OSV malware advisory MAL-2026-15554 blocks this version. On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to https://ipcheck-ha...

OpenSSF/OSV malware advisory MAL-2026-15556 blocks this version. index.js runs getToken() at module load time. The destination URL is reconstructed from a numeric char-code array via Stri...

OpenSSF/OSV malware advisory MAL-2026-15559 blocks this version. Package is advertised as a lightweight TOTP/HOTP library, but its package.json declares a postinstall hook (`node lib/core...

OpenSSF/OSV malware advisory MAL-2026-15549 blocks this version. Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a prein...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-15547 blocks this version. The package advertises itself as a TOTP/2FA helper but its package.json postinstall spawns lib/core.js as a detached, stdi...

OpenSSF/OSV malware advisory MAL-2026-14805 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14788 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14801 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14794 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14791 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14797 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14800 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code