npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14187 blocks this version. scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform s...

OpenSSF/OSV malware advisory MAL-2026-14180 blocks this version. The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attack...

OpenSSF/OSV malware advisory MAL-2026-14183 blocks this version. lodhash-cli is a lodash-typosquat whose main entry (index.js) exports an empty object; the package's only behavior is a po...

OpenSSF/OSV malware advisory MAL-2026-14178 blocks this version. ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code i...

OpenSSF/OSV malware advisory MAL-2026-14184 blocks this version. lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two host...

OpenSSF/OSV malware advisory MAL-2026-14181 blocks this version. Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two h...

OpenSSF/OSV malware advisory MAL-2026-14179 blocks this version. loadashjs is a lodash typosquat whose index.js exports an empty object; the only functional code is scripts/postinstall.js...

OpenSSF/OSV malware advisory MAL-2026-14182 blocks this version. lodash-lib@1.0.0 typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts...

OpenSSF/OSV malware advisory MAL-2026-14171 blocks this version. comander-lib@1.0.0 is a typosquat of `commander` with an empty index.js and no native sources. Its scripts/postinstall.js...

OpenSSF/OSV malware advisory MAL-2026-14173 blocks this version. The postinstall script in commandor-core@1.0.0 (scripts/postinstall.js) contains XOR-obfuscated byte arrays that decode at...

OpenSSF/OSV malware advisory MAL-2026-14174 blocks this version. commandorjs@1.0.0 is a dropper disguised as an npm library. Its index.js exports an empty object; the only functional code...

OpenSSF/OSV malware advisory MAL-2026-14172 blocks this version. The postinstall script in commandor-cli@1.0.0 (scripts/postinstall.js) XOR-decodes a hardcoded URL using key 'stf2026' tha...

OpenSSF/OSV malware advisory MAL-2026-14170 blocks this version. comander-cli is a typosquat of the popular 'commander' package whose index.js exports an empty object, providing no advert...

OpenSSF/OSV malware advisory MAL-2026-14169 blocks this version. On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host pla...

OpenSSF/OSV malware advisory MAL-2026-14168 blocks this version. chalk-util@1.0.0 is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scr...

OpenSSF/OSV malware advisory MAL-2026-14166 blocks this version. Package name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On...

OpenSSF/OSV malware advisory MAL-2026-14167 blocks this version. chalk-lib is a typosquat of the popular chalk package with an empty library body (index.js exports {}) whose entire effect...

OpenSSF/OSV malware advisory MAL-2026-14165 blocks this version. chalk-core@1.0.0 typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object....

OpenSSF/OSV malware advisory MAL-2026-6406 blocks this version. Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveill...

OpenSSF/OSV malware advisory MAL-2026-14190 blocks this version. The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments r...