npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14991 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14873 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

The package uses an automatic npm lifecycle hook to write and prune skills in both Codex and Claude user directories. This is unconsented postinstall mutation of a broad AI-agent control...

The package performs unconsented postinstall writes and deletions in both Codex and Claude user skill locations. This meets the install-control-surface policy for blocking.

This package performs an automatic postinstall write to global Codex and Claude skill directories and prunes their contents. That concrete lifecycle control-surface mutation meets the blo...

The package automatically mutates the global Claude skills directory and installs instructions that take effect across Claude responses. This is unconsented install-time control-surface m...

The package has a concrete automatic postinstall path that injects and prunes skills in two unrelated agent homes. This meets the install-time AI-agent control-surface abuse policy.

OpenSSF/OSV malware advisory MAL-2026-14880 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14961 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14879 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14828 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14858 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14863 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14906 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14886 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

The confirmed postinstall hook modifies both Codex and Claude configuration trees without a user-invoked setup action. This meets the policy threshold for malicious install-hook abuse eve...

This package uses an automatic install hook to persist a GitHub Actions workflow in a consumer repository and transmit repository metadata externally. The behavior is unconsented install-...

A registry-install lifecycle hook modifies both Codex and Claude user skill directories and prunes their contents without an explicit user setup action. This meets the install-time AI-age...

OpenSSF/OSV malware advisory MAL-2026-14577 blocks this version. The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, whi...

OpenSSF/OSV malware advisory MAL-2026-14850 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14993 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code