npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14156 blocks this version. typscript-cli is a typosquat of 'typescript' (index.js exports an empty object; no library functionality). Its scripts/pos...

OpenSSF/OSV malware advisory MAL-2026-14145 blocks this version. typecript-cli@1.0.0 is a typosquat of 'typescript' whose scripts/postinstall.js performs an install-time dropper attack. P...

OpenSSF/OSV malware advisory MAL-2026-14142 blocks this version. scripts/postinstall.js runs at npm install and performs an install-time dropper chain. A URL stored as an integer array is...

This is a concrete, automatically triggered mutation of an authenticated user account driven by remotely supplied targets. It is unrelated to the stated library function and requires no e...

Source directly establishes collection of device identifiers and their transmission to an unrelated endpoint when the generator is used. Although it is user-command triggered rather than...

This is a concrete staged remote-code-execution chain hidden behind a transaction-data API. The absence of lifecycle hooks does not mitigate runtime execution after an ordinary library call.

OpenSSF/OSV malware advisory MAL-2026-14134 blocks this version. On `npm install`, the package's preinstall hook runs `node beacon.js`, which collects host identity (os.hostname(), os.use...

OpenSSF/OSV malware advisory MAL-2026-14138 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-14139 blocks this version. The package declares `preinstall: "node index.js"`, which fires automatically on `npm install`. index.js collects host ide...

OpenSSF/OSV malware advisory MAL-2026-14137 blocks this version. Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2wo...

OpenSSF/OSV malware advisory MAL-2026-14135 blocks this version. The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install,...

The package has no install hook, but its runtime code automatically uploads selected CI environment secrets to a hardcoded remote endpoint. This is concrete credential exfiltration, not m...

The package's automatic postinstall modifies both ~/.claude.json and ~/.codex/config.toml to install a package-controlled MCP server. This meets the block policy for unconsented install-t...

The lifecycle hook performs concrete cross-agent persistence and automatic enablement, meeting the firewall block condition. The inspected network and dynamic-code primitives do not mitig...

The package has a concrete install-time mutation of a foreign global AI-agent command surface. Its lack of observed exfiltration reduces scope but does not remove the command-hijack risk.

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14121 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-14122 blocks this version. index.js unconditionally requires./_perf.js on load. _perf.js reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, ~/.aws/...