npm security reports, with evidence.

Source inspection confirms reachable, targeted disruptive behavior in the distributed browser bundle. The lack of an install hook does not mitigate import-time protestware.

Static source inspection confirms a targeted, delayed browser-disruption payload with a fixed remote media endpoint. No install hook is needed because the malicious code executes when the...

This is concrete install-time spyware and remote-control behavior, not an inert bundled application. The hard-coded endpoint, screen exfiltration, and remote UI automation establish a mal...

OpenSSF/OSV malware advisory MAL-2026-14048 blocks this version. The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xel...

OpenSSF/OSV malware advisory MAL-2026-14048 blocks this version. The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xel...

OpenSSF/OSV malware advisory MAL-2026-14050 blocks this version. package.json for @polymarkets/clob-client-v2 declares its inquirer dependency as an HTTPS tarball URL on registrynpmjs.to,...

OpenSSF/OSV malware advisory MAL-2026-14049 blocks this version. Package published to the public npm registry under the @mexc scope without evidence of scope ownership. package.json decla...

OpenSSF/OSV malware advisory MAL-2026-14048 blocks this version. The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xel...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships heavily obfuscated runtime files (...

OpenSSF/OSV malware advisory MAL-2026-10711 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships heavily obfuscated runtime files (...

OpenSSF/OSV malware advisory MAL-2026-14047 blocks this version. On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub...

OpenSSF/OSV malware advisory MAL-2026-14047 blocks this version. On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub...

OpenSSF/OSV malware advisory MAL-2026-14047 blocks this version. On invocation of `agent-proxy start`, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub...

This is concrete, unconsented install-time reconnaissance, exfiltration, persistence, and cross-project mutation. The path guard limits targeting but does not make the behavior benign.

The bundle contains concrete, targeted browser-disruption behavior and external audio loading unrelated to its checkout purpose. Absence of an install hook does not mitigate the import-ti...

This is concrete, unconsented install-time reconnaissance and exfiltration rather than a package-aligned function. The environment guard narrows targeting but does not remove the maliciou...

This is concrete unconsented install-time reconnaissance, exfiltration, persistence, and filesystem mutation. The path gate and stated research purpose do not remove the malicious behavio...

The cwd guard narrows targeting but does not make the lifecycle-triggered internal reconnaissance consensual. Collection is retained locally and TLS validation is disabled.

Source confirms a concrete install-time chain of data collection, webhook exfiltration, detached daemon persistence, and cross-build enumeration. The hard-coded environment guard and clai...

This is concrete install-time persistence, cross-tenant reconnaissance, remote exfiltration, and runtime-code modification. The research-oriented comments do not negate the implemented be...

OpenSSF/OSV malware advisory MAL-2026-14045 blocks this version. The npm package @ferudionz/webautomation exposes a single function connet(x) whose sole behavior is to POST the caller-sup...