npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13920 blocks this version. The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect install...

OpenSSF/OSV malware advisory MAL-2026-13920 blocks this version. The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect install...

OpenSSF/OSV malware advisory MAL-2026-13922 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home di...

OpenSSF/OSV malware advisory MAL-2026-13923 blocks this version. The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, append...

OpenSSF/OSV malware advisory MAL-2026-13921 blocks this version. envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs wheneve...

The exported runtime behavior is an unauthenticated remote payload loader and executor, unrelated to the stated trading utility purpose. Lack of lifecycle hooks limits activation to API u...

OpenSSF/OSV malware advisory MAL-2026-13919 blocks this version. @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script (index.js/callback.js) that executes `id` and `hostname`...

OpenSSF/OSV malware advisory MAL-2026-13918 blocks this version. The package presents itself as an n8n helper node but ships only a stub node (nodes/PwnNode.node.js) and a postinstall scr...

OpenSSF/OSV malware advisory MAL-2026-13917 blocks this version. Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file (nodes/PwnNode.node.js,...

OpenSSF/OSV malware advisory MAL-2026-13916 blocks this version. On `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host...

OpenSSF/OSV malware advisory MAL-2026-13914 blocks this version. The package auto-executes a reconnaissance and exfiltration payload both at install (via scripts.postinstall running callb...

OpenSSF/OSV malware advisory MAL-2026-13913 blocks this version. The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-id...

OpenSSF/OSV malware advisory MAL-2026-13912 blocks this version. The package runs a hostile payload both from its declared postinstall hook (`node callback.js`) and at library load via `i...

OpenSSF/OSV malware advisory MAL-2026-13911 blocks this version. On npm install, callback.js/index.js (invoked from the package's postinstall/main) executes `id` and `hostname`, reads `/e...

OpenSSF/OSV malware advisory MAL-2026-13910 blocks this version. On npm install (postinstall) and on require/import of the package's main entry, callback.js and index.js execute `id`, `ho...

OpenSSF/OSV malware advisory MAL-2026-13909 blocks this version. The package's postinstall script (callback.js) and its main module (index.js, byte-identical to callback.js) execute on bo...

OpenSSF/OSV malware advisory MAL-2026-13908 blocks this version. The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.no...

OpenSSF/OSV malware advisory MAL-2026-13907 blocks this version. The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to c...

OpenSSF/OSV malware advisory MAL-2026-13906 blocks this version. The package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code...

OpenSSF/OSV malware advisory MAL-2026-13902 blocks this version. The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.2...

OpenSSF/OSV malware advisory MAL-2026-13901 blocks this version. The package declares `postinstall: node callback.js` and its `main` (index.js) is byte-identical to callback.js, so both `...