npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13734 blocks this version. @aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate func...

OpenSSF/OSV malware advisory MAL-2026-13734 blocks this version. @aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate func...

OpenSSF/OSV malware advisory MAL-2026-13738 blocks this version. @openzeppelin-5/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13738 blocks this version. @openzeppelin-5/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13737 blocks this version. @openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13737 blocks this version. @openzeppelin-4/contracts is a malicious npm package published by npm account `mssjeep843` that impersonates OpenZeppelin'...

OpenSSF/OSV malware advisory MAL-2026-13736 blocks this version. The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-<platform>-<ar...

The package has a concrete, install-time AI-agent control-surface mutation that installs automatic command execution. This meets the firewall block boundary despite its disclosed notifica...

Direct source inspection found a deceptive, obfuscated redirect that forwards browser query parameters to a concealed endpoint. The absence of npm lifecycle hooks does not mitigate this r...

Source inspection confirms a concrete npm postinstall chain that mutates Claude Code settings and installs event-triggered commands. This meets the blocking policy for unconsented postins...

Source confirms an install-time, user-wide Cursor MCP and command mutation. This meets the firewall block boundary for unconsented postinstall mutation of a foreign AI-agent control surface.

Although the stated feature is benign and documented, the package performs the policy-defined blocking behavior: postinstall mutation of a foreign AI-agent control surface. No exfiltratio...

This package performs unconsented install-time staging of unverified remote executables and establishes a later execution/update chain. That is a concrete remote-payload execution risk, n...

Source establishes import-time child-process launch followed by obfuscated network retrieval and dynamic execution. Absence of lifecycle hooks does not mitigate this runtime backdoor.

Source confirms default remote transmission of GitHub Actions identity credentials and runtime secrets to a package-controlled endpoint. The absence of install hooks does not remove this...

Source inspection confirms an unconsented postinstall mutation of broad Claude project controls, plus a telemetry chain that accesses session metadata and transcript-derived usage. This m...

Direct source inspection confirms concrete credential/session theft and exfiltration behavior in index.js. The lack of lifecycle hooks limits automatic activation but does not negate the...

The payload implements concrete credential harvesting and exfiltration, not merely risky primitives. Lack of an install hook limits automatic activation but does not make the directly exe...

OpenSSF/OSV malware advisory MAL-2026-13721 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced code findings were...

The package’s proxy behavior is plausible, but automatic daemon startup and login persistence during postinstall are concrete harmful behavior outside an explicit user action.

This is a concrete, default-enabled external logging/exfiltration path for rich host application data, not merely a generic HTTP capability. No installation hook is needed for the runtime...