npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13625 blocks this version. This package presents itself as a routine Nuxt republish with dependency bumps, but ships two coordinated modifications th...

OpenSSF/OSV malware advisory MAL-2026-13623 blocks this version. @depup/aws-sdk__credential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process pac...

The package contains a concrete remote-payload execution chain, not merely a dynamic-evaluation primitive. Although it is user-invoked rather than install-time, the hard-coded external lo...

OpenSSF/OSV malware advisory MAL-2026-13618 blocks this version. When WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the pac...

OpenSSF/OSV malware advisory MAL-2026-13618 blocks this version. When WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the pac...

OpenSSF/OSV malware advisory MAL-2026-13618 blocks this version. When WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the pac...

OpenSSF/OSV malware advisory MAL-2026-13621 blocks this version. The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream app...

OpenSSF/OSV malware advisory MAL-2026-13621 blocks this version. The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream app...

OpenSSF/OSV malware advisory MAL-2026-13621 blocks this version. The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream app...

OpenSSF/OSV malware advisory MAL-2026-13621 blocks this version. The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream app...

OpenSSF/OSV malware advisory MAL-2026-13620 blocks this version. The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname(), os.u...

OpenSSF/OSV malware advisory MAL-2026-13615 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package runs as a persistent daemon that opens a...

OpenSSF/OSV malware advisory MAL-2026-13615 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package runs as a persistent daemon that opens a...

OpenSSF/OSV malware advisory MAL-2026-13615 blocks this version. The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.f...

OpenSSF/OSV malware advisory MAL-2026-13614 blocks this version. The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the re...

OpenSSF/OSV malware advisory MAL-2026-13614 blocks this version. The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the re...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-13613 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. big-tss@5.0.5 impersonates the popular big.js arbitr...

OpenSSF/OSV malware advisory MAL-2026-13612 blocks this version. package.json declares the package's own name as a dependency (and devDependency) with the specifier http://pack.nppacks.co...

OpenSSF/OSV malware advisory MAL-2026-13449 blocks this version. package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https:/...