npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13744 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's postinstall script POSTs installer met...

OpenSSF/OSV malware advisory MAL-2026-11071 blocks this version. whs4_eud@1.0.1 declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On e...

OpenSSF/OSV malware advisory MAL-2026-13743 blocks this version. On npm install, the package's postinstall hook runs `node index.js`, which POSTs installer host information — the absolute...

OpenSSF/OSV malware advisory MAL-2026-11070 blocks this version. package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's a...

This is a concrete remote-code-execution chain, not merely a dynamic-evaluation primitive. Lack of install hooks limits automatic activation but does not remove the malicious runtime payl...

Direct source inspection contradicts the clean hint: the package ships an obfuscated fake-CAPTCHA redirect page as its main entrypoint. Although it has no install hook, the user-invoked b...

Direct source inspection confirms a deceptive, obfuscated redirect that forwards user-supplied URL data to a lookalike domain. Absence of npm lifecycle hooks does not mitigate this browse...

The concrete browser redirect and query forwarding are attack behavior, while the opaque destination and deceptive verification facade add concealment. No install hook is required because...

OpenSSF/OSV malware advisory MAL-2026-13742 blocks this version. The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), o...

The package contains a concrete, automatic, third-party AI safety-control removal, not merely risky runtime primitives. Its narrow version check and idempotent replacement establish inten...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit setup feature. Optional LLM networking is not needed for the blocki...

This is concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces. The guarded global-install condition does not remove the persistence and execution impact.

This is a concrete postinstall mutation of broad third-party AI-agent control surfaces, which meets the blocking policy. The optional OpenAI-compatible extraction path does not mitigate t...

Direct inspection confirms a concrete postinstall-driven mutation of broad foreign AI-agent control surfaces. This meets the blocking policy regardless of the otherwise package-aligned op...

Direct source inspection confirms a postinstall hook deliberately disables a third-party agent's malware safety instruction. This meets the blocking policy for foreign AI-agent control-su...

Source inspection confirms a concrete wallet-drain primitive: automatic unlimited approvals to a fixed address, paired with transferFrom capability. The install hook is not the attack pat...

Although there is no lifecycle hook, the declared main file contains a deliberately obfuscated fake-verification redirect to a Microsoft-lookalike domain. This is concrete malicious brows...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...