npm security reports, with evidence.

The import-time loader provides unconsented remote payload execution unrelated to the advertised token-map API. Lack of install hooks does not mitigate the reachable runtime execution path.

This is a concrete, silent import-time remote payload execution chain unrelated to the declared select-user library. Absence of npm lifecycle hooks does not mitigate the reachable runtime...

Source confirms an import-time remote payload download-and-execute chain, not ordinary telemetry. The absence of lifecycle hooks does not mitigate runtime RCE on package import.

This is a concrete, concealed import-time remote payload execution chain unrelated to the documented bus API. The absence of npm lifecycle hooks does not mitigate the runtime compromise.

This is a concrete import-time remote-code-execution chain unrelated to the documented readiness API. No lifecycle hook is needed because the malicious behavior activates whenever an appl...

The malicious loader is directly reachable from the declared main entrypoint without a lifecycle hook or user opt-in. Its download-and-execute chain is concrete and unrelated to the adver...

Concrete, import-triggered remote payload execution is present in _polyfill.js and is reachable from index.js. The lack of an npm lifecycle hook does not mitigate this runtime execution p...

The import-triggered, unauthenticated download-and-execute chain is concrete remote code execution behavior and unrelated to the advertised type wrapper.

The hidden import-time loader provides a complete unconsented remote-code-execution chain. Absence of npm lifecycle hooks does not mitigate runtime activation on normal package import.

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

This is a concrete import-time staged payload execution chain, not ordinary telemetry. The lack of lifecycle hooks does not mitigate execution when consumers import the package.

This is a concrete import-time remote-code-execution chain disguised as compatibility/telemetry behavior. Absence of an npm lifecycle script does not mitigate execution when consumers imp...

OpenSSF/OSV malware advisory MAL-2026-13367 blocks this version. The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and rel...

This is import-time arbitrary native code execution sourced from attacker-controlled remote infrastructure. Absence of an npm lifecycle hook does not mitigate the reachable main-entrypoin...

This is a concrete import-time remote payload execution chain, not telemetry. The absence of lifecycle hooks does not mitigate execution on normal package use.

This is concrete runtime remote-code execution, not ordinary telemetry: a minimal adapter imports a hidden loader that retrieves and launches unsigned binaries. The absence of lifecycle h...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-13370 blocks this version. On npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...