npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14543 blocks this version. Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, onc...

OpenSSF/OSV malware advisory MAL-2026-14550 blocks this version. tset_racie@1.0.3 ships a single 45KB obfuscator.io-style payload as its main entry (index.js). The file consists of a 551-...

OpenSSF/OSV malware advisory MAL-2026-14550 blocks this version. tset_racie@1.0.3 ships a single 45KB obfuscator.io-style payload as its main entry (index.js). The file consists of a 551-...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14544 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

Source inspection confirms local-data transmission to hard-coded third-party Telegram destinations plus broad automatic postinstall mutation. Although the network actions require named CL...

The lifecycle hook performs forced upgrades of registered external projects, including agent instruction and skill locations, rather than limiting setup to the package directory. This mee...

Source inspection confirms an unconsented postinstall writes to Herdr's plugin and configuration paths, then installs a detached clipboard-handling process. This meets the block policy fo...

The source implements a concrete unconsented global postinstall chain that changes third-party AI-client control surfaces and installs remote native code. Product-aligned endpoints do not...

The package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise o...

This is an import-time remote code execution loader with an intentionally obscured endpoint. It is concrete malicious behavior, regardless of the absence of lifecycle scripts.