npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14062 blocks this version. On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14061 blocks this version. probe.js runs automatically via package.json preinstall and postinstall hooks ("node probe.js || true"). On execution it c...

OpenSSF/OSV malware advisory MAL-2026-14059 blocks this version. On `npm install`, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWO...

OpenSSF/OSV malware advisory MAL-2024-9443 blocks this version. package.json declares a preinstall hook ("preinstall": "node index.js") that runs index.js automatically on npm install. in...

OpenSSF/OSV malware advisory MAL-2026-14060 blocks this version. The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the...

OpenSSF/OSV malware advisory MAL-2026-11043 blocks this version. The npm package `supplyhub` is a credential / SSH-key stealer. Its `package.json` declares a `postinstall` lifecycle hook...

OpenSSF/OSV malware advisory MAL-2026-14058 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The tarball stages an obfuscated JavaScript payload...

OpenSSF/OSV malware advisory MAL-2026-14057 blocks this version. package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js shells out vi...

The source establishes a concrete, automatic credential-transfer chain to a fixed external receiver. Documentation frames this as vault migration, but it does not remove the unconsented e...

The package contains a concrete automatic secret-upload path to a fixed remote host. The absence of install hooks reduces scope but does not negate the runtime credential exfiltration beh...

OpenSSF/OSV malware advisory MAL-2026-14055 blocks this version. The package declares a preinstall lifecycle script (preinstall.js) that reads a hex-encoded command from preinstall.json,...