npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. xerohub-discord-voice-v2 advertises itself as a Disc...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-13708 blocks this version. xerohub-discord-voice advertises a startVoiceJoiner(config) API for joining a Discord voice channel, but its sendTokenToCr...

OpenSSF/OSV malware advisory MAL-2026-13708 blocks this version. xerohub-discord-voice advertises a startVoiceJoiner(config) API for joining a Discord voice channel, but its sendTokenToCr...

OpenSSF/OSV malware advisory MAL-2026-13700 blocks this version. The package is published as `chai-as-deployer` but its tarball contains verbatim pino README/docs/type-definitions while t...

OpenSSF/OSV malware advisory MAL-2026-13688 blocks this version. Package @kuperka/chainguard-sdk@1.0.2 exposes a single payload, window.__VEIL__.init(), that on load harvests document.coo...

OpenSSF/OSV malware advisory MAL-2026-13694 blocks this version. env-local presents itself as a dotenv-compatible.env loader (README, keywords, and API mirror motdotla/dotenv), but lib/ma...

OpenSSF/OSV malware advisory MAL-2026-13695 blocks this version. hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (publis...

OpenSSF/OSV malware advisory MAL-2026-13695 blocks this version. hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (publis...

OpenSSF/OSV malware advisory MAL-2026-13695 blocks this version. hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (publis...

OpenSSF/OSV malware advisory MAL-2026-13695 blocks this version. hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (publis...

OpenSSF/OSV malware advisory MAL-2026-13695 blocks this version. hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (publis...

OpenSSF/OSV malware advisory MAL-2026-13695 blocks this version. hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (publis...

OpenSSF/OSV malware advisory MAL-2026-13696 blocks this version. index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC...

OpenSSF/OSV malware advisory MAL-2026-13693 blocks this version. index.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a U...

OpenSSF/OSV malware advisory MAL-2026-13674 blocks this version. Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetch...

OpenSSF/OSV malware advisory MAL-2026-13672 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package statist-browser-typed-client-eventea.projects.pwa...

OpenSSF/OSV malware advisory MAL-2026-13671 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package contains no code paths that read installer secret...

OpenSSF/OSV malware advisory MAL-2026-13670 blocks this version. LPM AI assessed this version as clean; the assessments disagree. Package statist-browser-typed-client-eventea.projects.pwa...

OpenSSF/OSV malware advisory MAL-2026-13692 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On import, index.js invokes postCallers() which reso...