npm security reports, with evidence.

This is a concrete import-time staged-payload execution chain, not merely telemetry. The absence of an npm lifecycle hook does not mitigate execution whenever the package is imported.

The package’s declared certificate API is unrelated to its import-time downloader/launcher. No lifecycle hook is needed because requiring the main entrypoint triggers the malicious chain.

Confirmed import-time staged payload download and detached execution is concrete malicious behavior, regardless of the absence of npm lifecycle hooks.

This is a concrete import-time remote code-execution chain, not ordinary telemetry: arbitrary remote bytes are executed without integrity verification or user invocation. The lack of inst...

This is a concrete import-time remote payload execution chain unrelated to the advertised adapter. No install hook is needed because requiring the normal entrypoint triggers it.

This is a concrete, stealthy import-time remote payload execution chain unrelated to the stated token utility. The lack of install hooks does not mitigate runtime compromise when consumer...

Source inspection confirms concrete import-time download-and-execute behavior. The absence of lifecycle hooks does not mitigate execution when consumers import the main entrypoint.

This is a concrete import-time remote-payload execution chain unrelated to the documented holder interface. No install hook is required for compromise.

OpenSSF/OSV malware advisory MAL-2026-13366 blocks this version. package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during `npm install`. The README describes...

OpenSSF/OSV malware advisory MAL-2026-13365 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. index.ts defines an exported _telemetry function tha...

OpenSSF/OSV malware advisory MAL-2026-13363 blocks this version. The `santaclaude` bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls `/api/control/clai...

OpenSSF/OSV malware advisory MAL-2026-13364 blocks this version. Package ships an agent daemon (`vanexa-agent start`, entry `bin/vanexa-agent.js`) that receives commands from a remote pho...

This is concrete, unconsented import-time remote code execution unrelated to the advertised logging middleware. The DNS fallback and obfuscated endpoints further establish a staged malwar...

The entrypoint reaches an automatic remote native-payload execution chain; it is unrelated to the documented minimal device-integration API. Lack of an npm lifecycle hook does not mitigat...

Source establishes an import-time staged payload download and detached native execution chain; no user action beyond importing the SDK is required. The telemetry-like naming and opt-out c...

This is concrete import-time staged-payload execution unrelated to the advertised cashback API. Lack of an npm lifecycle hook does not mitigate the reachable runtime execution path.

This is a concrete import-time staged payload loader with remote native-code execution, unrelated to the advertised logging middleware. The absence of npm lifecycle hooks does not mitigat...

This is a concrete, import-time remote payload execution chain unrelated to the advertised token interface. The absence of install hooks does not mitigate runtime compromise on ordinary i...

The package's advertised API is inert, but its import-time side module implements an unconsented download-and-execute chain. This is concrete malware behavior, not telemetry.

Direct inspection confirms an import-time downloader/executor unrelated to the declared test-component API. The absence of lifecycle hooks does not mitigate runtime arbitrary-code execution.