npm security reports, with evidence.

The package contains a concrete, enabled default path that exports runtime records and error data to hard-coded third-party webhooks. It has no install-time execution, but the application...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...