npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14205 blocks this version. The package's install lifecycle script (scripts.install="node index.js") automatically executes on npm install and loads l...

OpenSSF/OSV malware advisory MAL-2026-14206 blocks this version. @sarex-team/ui-kit runs a DNS-based out-of-band exfiltration beacon on both `npm install` (via package.json scripts.instal...

OpenSSF/OSV malware advisory MAL-2026-14207 blocks this version. The package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basena...

OpenSSF/OSV malware advisory MAL-2026-14204 blocks this version. Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo().us...

OpenSSF/OSV malware advisory MAL-2026-14210 blocks this version. On require('sui-graphql-rpc'), index.js loads lib/telemetry.js which reads ~/.gitconfig from the installer's home director...

OpenSSF/OSV malware advisory MAL-2026-14209 blocks this version. On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14177 blocks this version. Package name typosquats `fast-glob`. On `npm install`, the declared postinstall script resolves the installer's per-platfo...

OpenSSF/OSV malware advisory MAL-2026-14212 blocks this version. On invocation, index.js spawns start_tool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute...

OpenSSF/OSV malware advisory MAL-2026-14213 blocks this version. The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload (pointer.py) th...

OpenSSF/OSV malware advisory MAL-2026-10428 blocks this version. The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. in...

OpenSSF/OSV malware advisory MAL-2026-10428 blocks this version. The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. in...

OpenSSF/OSV malware advisory MAL-2026-14211 blocks this version. sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailw...

OpenSSF/OSV malware advisory MAL-2026-14211 blocks this version. sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailw...

OpenSSF/OSV malware advisory MAL-2026-14211 blocks this version. sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailw...

OpenSSF/OSV malware advisory MAL-2026-14208 blocks this version. index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a ~149 KB obfuscated Function(...) payload conc...

OpenSSF/OSV malware advisory MAL-2026-14214 blocks this version. Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json ma...

OpenSSF/OSV malware advisory MAL-2026-14214 blocks this version. Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json ma...