npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-15497 blocks this version. package.json declares a dependency whose key is the package's own name (`amplitude-session-replay`) and whose value is a p...

OpenSSF/OSV malware advisory MAL-2026-15511 blocks this version. package.json at line 11 declares a self-named dependency `intuit-authz` whose source is the bare HTTPS URL `https://repo.s...

OpenSSF/OSV malware advisory MAL-2026-15523 blocks this version. package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sy...

OpenSSF/OSV malware advisory MAL-2026-15496 blocks this version. package.json declares a single dependency whose key equals the package's own name (`amplitude-experiment`) and whose sourc...

OpenSSF/OSV malware advisory MAL-2026-15521 blocks this version. package.json declares a dependency whose key equals the package's own name (search-reservation) and whose value is the bar...

OpenSSF/OSV malware advisory MAL-2026-15517 blocks this version. package.json declares a dependency whose key equals the package's own name (`one-intuit-help-system-utils`) and whose valu...

OpenSSF/OSV malware advisory MAL-2026-15491 blocks this version. index.js contains an IIFE that fires on require() and walks the installer's home and project directories collecting.env* f...

OpenSSF/OSV malware advisory MAL-2026-15491 blocks this version. index.js contains an IIFE that fires on require() and walks the installer's home and project directories collecting.env* f...

The package performs silent, forced postinstall writes into multiple AI assistant configuration directories. That is a concrete unconsented broad agent-control-surface mutation, despite n...

Direct source inspection confirms an automatic install hook that executes remote code and persists it through shell profiles and cron. The benign runtime export does not mitigate this con...

This is a concrete install-time remote-code-execution and persistence chain unrelated to the package's exported utilities. The package should be blocked.

The confirmed preinstall hook performs concealed remote code execution from an unreviewable payload. The harmless-looking runtime stub does not mitigate this install-time behavior.

The package contains a confirmed automatic install-time remote-code-execution chain. Its minimal runtime code does not justify or constrain that behavior.

OpenSSF/OSV malware advisory MAL-2026-14841 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14819 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14809 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14807 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14813 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14823 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14810 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code