npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13881 blocks this version. On `npm install`, the package's preinstall hook executes index.js, which collects installer identity and host information...

The package performs concrete global postinstall rewrites across multiple third-party AI-agent control surfaces. That meets the firewall block boundary despite the absence of observed exf...

OpenSSF/OSV malware advisory MAL-2026-13815 blocks this version. Package contains a single index.html declared as `main` that impersonates a Cloudflare 'Just a moment…' verification page,...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13769 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. No a static rule matches or traced behavior indicati...

OpenSSF/OSV malware advisory MAL-2026-13768 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Analysis of the package did not surface install-time life...

OpenSSF/OSV malware advisory MAL-2026-13768 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Analysis of the package did not surface install-time life...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13778 blocks this version. No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13844 blocks this version. Package contains only index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a...

OpenSSF/OSV malware advisory MAL-2026-13763 blocks this version. Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author meta...

OpenSSF/OSV malware advisory MAL-2026-13835 blocks this version. Package truecxikdsal@1.0.0 contains 2 files and no static or traced findings indicate exfiltration, install-time code exec...

OpenSSF/OSV malware advisory MAL-2026-13796 blocks this version. Package cvbmxiowkwqla6@1.0.0 contains only two files and no behaviors matching supply-chain attack patterns were identifie...

OpenSSF/OSV malware advisory MAL-2026-13792 blocks this version. Package chmjdsidwlf5@1.0.0 contains 2 files with no a static rule matches and no traced behavior indicating exfiltration,...

OpenSSF/OSV malware advisory MAL-2026-13807 blocks this version. The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no preinsta...

OpenSSF/OSV malware advisory MAL-2026-13846 blocks this version. The tarball's only shipped file is index.html, declared as the package's `main`. There are no lifecycle scripts, no JavaSc...

OpenSSF/OSV malware advisory MAL-2026-13845 blocks this version. The tarball contains only package.json and index.html. package.json declares main: "index.html", which is not a requirable...