npm security reports, with evidence.

This is concrete, unconsented postinstall mutation of foreign/broad AI-agent control surfaces. The lack of an install-time exfiltration request does not remove the control-hijack risk cre...

This is concrete, automatic install-time credential and host-data exfiltration to an unrelated fixed endpoint. The behavior is not required by the package’s placeholder runtime library.

The package performs unconsented postinstall mutation of a foreign AI-agent control surface for rebranding. Runtime authentication behavior does not mitigate that install-time tampering.

The package has a concrete, default postinstall remote-payload execution chain and stages unpinned externally fetched skills for activation. Opt-in protection for shared-path migration do...

This is concrete install-time mutation of a foreign AI-agent control surface, coupled with routing users to the package vendor's provider. The authentication network traffic is package-al...

OpenSSF/OSV malware advisory MAL-2026-14039 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package presents itself as a CDN static-asset distri...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...

OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...

OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...

OpenSSF/OSV malware advisory MAL-2026-14040 blocks this version. package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath(), which execFileSyncs preb...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-13366 blocks this version. package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes...

OpenSSF/OSV malware advisory MAL-2026-13366 blocks this version. package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...