npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14242 blocks this version. electro-session@0.1.3 presents itself as 'Session utilities' (~170-byte README) but ships ~1MB of heavily obfuscated JavaS...

OpenSSF/OSV malware advisory MAL-2026-12359 blocks this version. The package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/H...

OpenSSF/OSV malware advisory MAL-2026-12359 blocks this version. The package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/H...

OpenSSF/OSV malware advisory MAL-2026-12359 blocks this version. The package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/H...

OpenSSF/OSV malware advisory MAL-2026-14234 blocks this version. The package's scripts/postinstall.js runs automatically on npm install and imports child_process alongside http.request wi...

OpenSSF/OSV malware advisory MAL-2026-14238 blocks this version. The package's postinstall script runs automatically on npm install and collects host identifiers (os.hostname(), platform,...

OpenSSF/OSV malware advisory MAL-2026-14237 blocks this version. On npm install, the package's postinstall lifecycle script collects installer host identifiers (os.hostname(), process.pla...

OpenSSF/OSV malware advisory MAL-2026-14233 blocks this version. code-assist-mcp@1.0.0 runs a postinstall lifecycle script that collects host identifiers (hostname, platform, arch, Node v...

OpenSSF/OSV malware advisory MAL-2026-14232 blocks this version. The package's postinstall script runs on `npm install` and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.t...

OpenSSF/OSV malware advisory MAL-2026-14231 blocks this version. chromecast-webdriver-cli@1.0.0 runs a postinstall lifecycle script that collects host metadata (os.hostname(), platform, a...

OpenSSF/OSV malware advisory MAL-2026-14230 blocks this version. chrome-enterprise-premium-mcp ships a postinstall lifecycle script that fires automatically on `npm install` and POSTs ins...

OpenSSF/OSV malware advisory MAL-2026-14228 blocks this version. The package's postinstall script runs automatically on `npm install` and collects host identifiers from the installer mach...

OpenSSF/OSV malware advisory MAL-2026-14227 blocks this version. This npm package uses the name `bazelisk`, colliding with Google's bazelbuild/bazelisk project (referenced in the tarball'...

OpenSSF/OSV malware advisory MAL-2026-14239 blocks this version. gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher (`gaarf`)...

OpenSSF/OSV malware advisory MAL-2026-14236 blocks this version. The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers (os.h...

OpenSSF/OSV malware advisory MAL-2026-14226 blocks this version. plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a c...

OpenSSF/OSV malware advisory MAL-2026-14225 blocks this version. The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET t...

OpenSSF/OSV malware advisory MAL-2026-14225 blocks this version. The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET t...

This is concrete default-enabled data exfiltration to a hardcoded external endpoint, not merely local worklog functionality. The absence of an npm install hook does not remove the runtime...

OpenSSF/OSV malware advisory MAL-2026-14219 blocks this version. The package's lib/report.js requires child_process, fs, https, and os at the top of the module and constructs an HTTPS POS...