npm security reports, with evidence.

This is a concrete, automatically reachable remote-code-execution chain unrelated to the stated promocode SDK. The unused telemetry module contains a parallel payload-loader implementatio...

This is an import-time, covert remote-code-execution chain unrelated to the declared log formatter functionality. Lack of an npm lifecycle hook does not mitigate execution on normal packa...

The package's advertised logging behavior does not justify an import-time downloader and detached binary launcher. No lifecycle script is needed because the attack is activated by normal...

The downloader/executor is reachable at import time and its payload is fully remote-controlled, with obfuscated endpoints and concealed failure handling. This is concrete malware behavior...

The package contains a concrete, import-time arbitrary native payload execution chain. Its benign exported logger does not mitigate the hidden loader.

The import-time downloader and detached execution form a concrete remote-code-execution chain, independent of npm lifecycle hooks. The larger telemetry file contains a similarly capable c...

This is a concrete import-time remote-code-execution chain, not merely telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the package.

The import-time remote payload execution is concrete and unrelated to the minimal advertised SDK. Its detached execution chain creates direct arbitrary-code-execution risk.

This is concrete, unconsented runtime remote code execution unrelated to the package's stated subscription-holder API. Absence of lifecycle hooks does not mitigate import-time execution.

The import-time loader is unrelated to the advertised storage API and forms a concrete remote-code-execution chain. No lifecycle hook is needed because normal application use activates it.

This is a reachable import-time staged binary loader with remote execution, unrelated to the stated test-harness API. The lack of an install hook does not mitigate the concrete runtime ex...

The advertised abstraction has no need for an import-time remote executable loader. The concrete network-to-disk-to-detached-process chain is malicious remote code execution.

OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...

OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...

OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...

OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...

OpenSSF/OSV malware advisory MAL-2026-13277 blocks this version. The package's index.js reads installer-owned secret files from the home directory (~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ss...

OpenSSF/OSV malware advisory MAL-2026-13279 blocks this version. On require of the package's main, _platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Wor...

OpenSSF/OSV malware advisory MAL-2026-13272 blocks this version. The package's main entry (index.js) unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint...

OpenSSF/OSV malware advisory MAL-2026-13266 blocks this version. On require() of devplatform-table, index.js loads./_compat which selects a platform-specific payload path, downloads an ex...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...