npm security reports, with evidence.

Direct source inspection confirms a cookie-forwarding service-worker proxy bundled under an unrelated SVG package name. The absence of install hooks limits install-time impact but does no...

This is concrete install-time credential and data exfiltration with stealth/anti-analysis behavior, not package-aligned functionality. The package should be blocked.

OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...

OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...

OpenSSF/OSV malware advisory MAL-2026-6088 blocks this version. The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a <script> ele...

OpenSSF/OSV malware advisory MAL-2026-14321 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14319 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14319 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-13348 blocks this version. lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a s...

OpenSSF/OSV malware advisory MAL-2026-5896 blocks this version. The package advertises itself as a Jest plugin (name: 'jest-test-plugin-utils', description: 'mqtt utils') but ships no Jes...

OpenSSF/OSV malware advisory MAL-2026-14330 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14330 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

OpenSSF/OSV malware advisory MAL-2026-14320 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package was found to contain malicious code or c...

OpenSSF/OSV malware advisory MAL-2026-14329 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13451 blocks this version. nms-dashboard-js@9.9.11 declares an npm install lifecycle hook (`scripts.install: "node index.js"`) that unconditionally r...

OpenSSF/OSV malware advisory MAL-2026-10637 blocks this version. mc-reg advertises itself as a Cosmos chain-registry data package (README shows chain-registry-style `assets`/`chains`/`ibc...

OpenSSF/OSV malware advisory MAL-2026-10637 blocks this version. mc-reg advertises itself as a Cosmos chain-registry data package (README shows chain-registry-style `assets`/`chains`/`ibc...