npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-13714 blocks this version. @sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-fil...

OpenSSF/OSV malware advisory MAL-2026-13733 blocks this version. The newtun CLI opens a plaintext WebSocket to the hardcoded server pull.7ii.win:7999 and hands the remote peer complete co...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-13726 blocks this version. LPM AI assessed this version as clean; the assessments disagree. svelte-kit-streak@1.0.0 was scanned across 8 files with n...

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-13518 blocks this version. LPM AI assessed this version as clean; the assessments disagree. packages/core/src/index.ts and plugin.ts (compiled into d...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-6477 blocks this version. lib/index.cjs and lib/index.mjs (re-required from lib/readonly.cjs) contain a self-executing IIFE that decodes two opaque s...

OpenSSF/OSV malware advisory MAL-2026-13727 blocks this version. No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libra...

The postinstall hook concretely deletes foreign AI runtime packages during installation. Global-only scope and opt-outs reduce breadth but do not make the unconsented lifecycle mutation s...

This package disguises a backdoor ELF as a native calendar-math accelerator and executes it at import time. No lifecycle hook is needed for the concrete malicious runtime chain.