npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6562 blocks this version. Package targets the private @epic-common scope (Epic Games) and is published to the public npm registry as a dependency-con...

OpenSSF/OSV malware advisory MAL-2025-49192 blocks this version. The package epic-sso was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-49125 blocks this version. The package epic-common-node was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2025-49124 blocks this version. The package epic-common was found to contain malicious code.

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. Lack of exfiltration does not remove the install-time agent-control hijack behavior.

Direct source inspection confirms a hardcoded, enabled-by-default external telemetry upload of rich local AI/work-project data. The absence of an npm install hook does not remove the conc...

OpenSSF/OSV malware advisory MAL-2026-6183 blocks this version. preinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hos...

OpenSSF/OSV malware advisory MAL-2026-5401 blocks this version. savant-listing@999.9.9 is a dependency-confusion squat. package.json declares both `install` and `postinstall` lifecycle sc...

OpenSSF/OSV malware advisory MAL-2026-5401 blocks this version. savant-listing@999.9.9 is a dependency-confusion squat. package.json declares both `install` and `postinstall` lifecycle sc...

OpenSSF/OSV malware advisory MAL-2026-3724 blocks this version. On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as que...

OpenSSF/OSV malware advisory MAL-2026-14087 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-3353 blocks this version. The package money-badger-open-rpc was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.

OpenSSF/OSV malware advisory MAL-2026-3397 blocks this version. The package tecken was found to contain malicious code.