npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14276 blocks this version. The package presents itself as a Node.js cryptography helper and depends on ethers, encouraging callers to pass cryptograp...

OpenSSF/OSV malware advisory MAL-2026-14277 blocks this version. The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a to...

OpenSSF/OSV malware advisory MAL-2026-14275 blocks this version. package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileS...

OpenSSF/OSV malware advisory MAL-2026-14277 blocks this version. The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a to...

The hook performs concrete, automatic mutation of broad third-party AI-agent configuration during npm installation. This meets the firewall block boundary regardless of the absence of obs...

OpenSSF/OSV malware advisory MAL-2026-14273 blocks this version. The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of...

OpenSSF/OSV malware advisory MAL-2026-14270 blocks this version. The package installs a global keyboard hook (keyboard.add_hotkey on ctrl+c), polls the system clipboard every 300ms via py...

OpenSSF/OSV malware advisory MAL-2026-14271 blocks this version. The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JS...

The lifecycle hook concretely mutates multiple foreign, broad AI-agent control surfaces at install time. This satisfies the blocking policy even though no separate exfiltration endpoint w...

OpenSSF/OSV malware advisory MAL-2026-14267 blocks this version. On npm install, the package's postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, Node....

OpenSSF/OSV malware advisory MAL-2026-14269 blocks this version. The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSync(BI...

OpenSSF/OSV malware advisory MAL-2026-14264 blocks this version. package.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.c...

OpenSSF/OSV malware advisory MAL-2026-14265 blocks this version. package.json declares `"postinstall": "sudo node install.js"`, escalating to root on `npm install`. install.js is heavily...

OpenSSF/OSV malware advisory MAL-2026-14266 blocks this version. Package published as `electron-sessions` advertises itself as generic 'Session utilities' but ships a single 1.18MB heavil...

OpenSSF/OSV malware advisory MAL-2026-13342 blocks this version. index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (load...

OpenSSF/OSV malware advisory MAL-2026-14268 blocks this version. package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppa...

The package embeds covert, proactive collection instructions into its active agent system prompt and targets highly sensitive user data without an in-code consent gate. This exceeds a ben...

OpenSSF/OSV malware advisory MAL-2026-14262 blocks this version. The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hos...

OpenSSF/OSV malware advisory MAL-2026-14258 blocks this version. The package main (index.js) is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses creat...

OpenSSF/OSV malware advisory MAL-2026-14260 blocks this version. package.json advertises the package as a 'High-performance async network socket & runtime protocol engine', but the tarbal...

OpenSSF/OSV malware advisory MAL-2026-14259 blocks this version. package.json declares the dependency `@whiskeysockets/baileys` but resolves it from `github:rcedubot/X` instead of the npm...