npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11143 blocks this version. The npm package name `parallely` typosquats `concurrently`: package.json advertises the concurrently repository, author, a...

The lifecycle hook performs unconsented remote code execution through a downloaded installer. This concrete install-time execution chain warrants blocking.

The source establishes a concrete, default credential-exfiltration path to a fixed third-party host during normal login and automatic recovery. The lack of install hooks does not mitigate...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...