npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13847 blocks this version. The package presents itself as an n8n community node but ships a hostile payload in both callback.js (invoked from scripts...

OpenSSF/OSV malware advisory MAL-2026-13868 blocks this version. Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall (`node callback....

OpenSSF/OSV malware advisory MAL-2026-13867 blocks this version. This package presents itself as an n8n workflow helper but ships a near-empty node stub (nodes/PwnNode.node.js, ~213 bytes...

OpenSSF/OSV malware advisory MAL-2026-13866 blocks this version. The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js...

OpenSSF/OSV malware advisory MAL-2026-13865 blocks this version. The package's postinstall script (duplicated as the main module) runs unconditionally on npm install. It executes `id` and...

OpenSSF/OSV malware advisory MAL-2026-13864 blocks this version. The package's postinstall script and its main entry (index.js, byte-identical to callback.js) execute the same payload on...

Source inspection confirms the flagged lifecycle behavior directly. The global Claude Code command installation meets the blocking policy even though no exfiltration was found.

OpenSSF/OSV malware advisory MAL-2026-13803 blocks this version. The package's sole shipped file is index.html, a fake 'Cloudflare Verifying...' page containing an obfuscator.io-style scr...

OpenSSF/OSV malware advisory MAL-2026-13803 blocks this version. The package's sole shipped file is index.html, a fake 'Cloudflare Verifying...' page containing an obfuscator.io-style scr...

This is concrete default-on data exfiltration to a hardcoded public receiver after installation, not merely a user-configured reporting feature. The absence of an npm install lifecycle ho...

Source inspection confirms the policy-defined blocking condition: an unconsented postinstall mutates multiple foreign/broad AI-agent skill locations. The opt-out environment variable does...

The package performs unconsented postinstall delivery and installation of an unsigned remote native payload while explicitly aiming to bypass SmartScreen/Gatekeeper behavior. Hash verific...

Source confirms conditional but automatic upload of environment secrets to a fixed default external endpoint. The absence of lifecycle hooks reduces install-time risk but does not remove...

The global-install guards reduce scope but do not establish user consent for changing Claude Code configuration. This matches the blocking policy for install-time mutation of a foreign AI...

The concrete automatic credential-transfer path to a fixed external receiver is sufficient for a block verdict. The lack of install hooks limits the trigger but does not remove the CI exf...

The lifecycle hook directly reaches both foreign AI-agent skill writes and persistence. Although no credential theft or remote payload execution was found, the postinstall control-surface...

This is an unconsented postinstall mutation of a foreign AI-agent control surface, which meets the upstream firewall block policy. No exfiltration was found, but it does not mitigate the...

The package has a concrete unconsented postinstall remote-code-execution chain. Vendor-named endpoints and opt-outs do not remove the install-time execution risk.

The postinstall hook performs unconsented mutation of foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface bloc...

The lifecycle hook performs broad, persistent AI-agent configuration mutation in a consuming project and changes package-manager lifecycle behavior. This meets the install-time foreign/br...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces during global installation. Under the stated policy this is block-worthy even without sep...