npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13508 blocks this version. On require of the package, index.js loads lib/telemetry.js which, together with _bootstrap.js, fetches a platform-specific...

OpenSSF/OSV malware advisory MAL-2026-13505 blocks this version. On require() of the package's main entry, dolyame-ui-iconloaderhoc@35.8.1 executes two dropper paths that fetch platform-s...

OpenSSF/OSV malware advisory MAL-2026-13477 blocks this version. LPM AI assessed this version as clean; the assessments disagree. No a static rule matches and no traced behaviors of conce...

OpenSSF/OSV malware advisory MAL-2026-13492 blocks this version. The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-ti...

OpenSSF/OSV malware advisory MAL-2026-13563 blocks this version. On require() of dolyame-ui-controlgroup, _compat.js selects a per-OS/arch URL and downloads a native binary from string-sp...

OpenSSF/OSV malware advisory MAL-2026-13519 blocks this version. The package advertises itself as a streak/calendar math library, but its main entry `dist/index.mjs` contains a top-level...

The package performs concealed remote payload retrieval and execution during ordinary import, without a user-invoked setup action. This is concrete malware behavior despite the absence of...

The package contains concrete import-time, unverified remote binary execution rather than telemetry-only behavior. The lack of install hooks does not reduce the runtime RCE risk.

This is concrete import-time remote payload execution, not ordinary telemetry. No install hook is needed because requiring the advertised package entrypoint triggers the behavior.

This is a concrete import-time remote payload execution chain, unrelated to the stated data-transformation purpose. The absence of lifecycle scripts does not mitigate execution on normal...

This is a concrete, automatically triggered remote payload execution chain unrelated to the declared UI-helper package purpose. No install hook is needed because the malicious behavior ex...

The import-time downloader and detached execution chain is concrete and does not require a lifecycle hook. The telemetry naming and opt-out variables do not mitigate arbitrary remote bina...

This is a concrete import-time remote native payload execution chain unrelated to a click-outside HOC package. The lack of an install hook does not mitigate execution when consumers impor...

OpenSSF/OSV malware advisory MAL-2026-12004 blocks this version. The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nod...

The import-time downloader/executor is concrete malicious behavior, not normal telemetry. Absence of npm lifecycle hooks does not mitigate runtime execution on import.

This is concrete, silent remote code execution on package import, unrelated to the stated data-transformation purpose. The absence of an install hook does not mitigate the import-time exe...

The package contains an import-time remote binary downloader and launcher disguised as telemetry. The lack of install hooks does not mitigate runtime arbitrary code execution on import.

The package has no install hook, but its normal import path automatically downloads and executes remote, unverified binaries. The claimed telemetry/profiler functionality does not justify...

This is concrete, automatic remote payload execution on ordinary package import, not legitimate telemetry behavior.

The concrete import-time remote-payload download and detached execution chain establishes malicious behavior. Lack of an npm lifecycle hook does not reduce the runtime RCE impact.