npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

The package performs an unconsented postinstall mutation of a consuming project's GitHub Actions configuration and establishes later network reporting. This is a concrete persistence and...

The package performs forced, silent postinstall writes to multiple foreign AI-agent configuration locations. This meets the blocking policy for unconsented lifecycle mutation of a broad A...

Source directly shows silent transmission of sensitive account configuration to an unrelated remote logging endpoint during normal runtime. The benign workspace-only postinstall hook does...

This is a concrete credential-exfiltration path to an unrelated logging endpoint during normal application initialization. No install hook is required for the harm to occur.

OpenSSF/OSV malware advisory MAL-2026-14580 blocks this version. The package '@postman-cse/okta-aio-darwin-arm64' was identified as containing malicious obfuscated code.

Source inspection confirms an all-sites extension that captures login credentials and sends them to a hard-coded remote endpoint. The confirmation prompt does not remove the material mism...

The package performs unconsented postinstall mutation of a consumer repository and installs persistent workflow code that reports repository metadata externally. This is concrete unwanted...