npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13955 blocks this version. The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When r...

OpenSSF/OSV malware advisory MAL-2026-13982 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. in-install@99.9.1 declares its `ltidisafe` dependenc...

OpenSSF/OSV malware advisory MAL-2026-13983 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package `knip-bun` typosquats the popular `knip` lin...

OpenSSF/OSV malware advisory MAL-2026-13977 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package name resembles the widely-used 'cspell' library b...

OpenSSF/OSV malware advisory MAL-2026-13987 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. resolve-audit@99.9.1 is a stub package (index export...

OpenSSF/OSV malware advisory MAL-2026-13976 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. check-audit@99.9.1 is an otherwise empty package (no...

OpenSSF/OSV malware advisory MAL-2026-13981 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. eslint-publish-release@99.9.1 is a hollow package (i...

OpenSSF/OSV malware advisory MAL-2026-13980 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. eslint-generate-release@99.9.1 is a hollow package w...

OpenSSF/OSV malware advisory MAL-2026-13979 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package ships an empty module (index.js = 'module.ex...

OpenSSF/OSV malware advisory MAL-2026-13984 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. napi-raw@99.9.1 is a near-empty wrapper (main export...

OpenSSF/OSV malware advisory MAL-2026-13990 blocks this version. On `npm install`, the package's postinstall lifecycle script collects installer host identifiers (hostname, platform, arch...

OpenSSF/OSV malware advisory MAL-2026-13950 blocks this version. fmt-util-k7x2@1.0.1 advertises itself as a trivial string-formatting utility (index.js exports two-line pad/trim helpers),...

OpenSSF/OSV malware advisory MAL-2026-13950 blocks this version. fmt-util-k7x2@1.0.1 advertises itself as a trivial string-formatting utility (index.js exports two-line pad/trim helpers),...

OpenSSF/OSV malware advisory MAL-2026-13988 blocks this version. The package's postinstall lifecycle script runs automatically on `npm install` and collects installer host identifiers (ho...

OpenSSF/OSV malware advisory MAL-2026-13744 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's postinstall script POSTs installer met...

OpenSSF/OSV malware advisory MAL-2026-12183 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Package is a weaponized mass-mail / SMS spam and phi...

OpenSSF/OSV malware advisory MAL-2026-14016 blocks this version. package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commo...

OpenSSF/OSV malware advisory MAL-2026-14016 blocks this version. package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commo...

OpenSSF/OSV malware advisory MAL-2026-13991 blocks this version. index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported fu...

OpenSSF/OSV malware advisory MAL-2026-13991 blocks this version. index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported fu...

OpenSSF/OSV malware advisory MAL-2026-13989 blocks this version. package.json declares a postinstall script that runs `node -e` to invoke fs.writeFileSync, creating /tmp/PWN_R3REAL/FIRED...