npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13342 blocks this version. index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (load...

OpenSSF/OSV malware advisory MAL-2026-12386 blocks this version. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12386 blocks this version. fundraiserservpp@2.0.0 runs `node index.js` as a `preinstall` lifecycle script on `npm install`. The script collects host...

OpenSSF/OSV malware advisory MAL-2026-12043 blocks this version. The package is a platform-specific leaf (linux/arm64) whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt...

OpenSSF/OSV malware advisory MAL-2026-11139 blocks this version. kordyn@0.9.14 advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities ('...

OpenSSF/OSV malware advisory MAL-2026-11139 blocks this version. kordyn@0.9.14 advertises itself in package.json and README as an unimplemented placeholder for trivial streak utilities ('...

OpenSSF/OSV malware advisory MAL-2026-13348 blocks this version. lakk-analytics@9.9.11 runs `node index.js` from an npm install lifecycle hook, which loads `./lib/core` and constructs a s...

OpenSSF/OSV malware advisory MAL-2026-13347 blocks this version. javas-crypto ships a postinstall hook (package.json line 11: "postinstall": "node setup.js") and a top-level autoExecute()...

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

This is concrete import-time remote payload execution unrelated to the declared toast interface. The absence of lifecycle hooks does not mitigate the reachable import trigger.

This is a concrete import-time remote payload execution chain unrelated to the package’s advertised minimal claims-domain API. No lifecycle hook is needed for it to execute in consumers.

Direct source inspection confirms an import-time remote payload execution chain, not merely telemetry primitives. The absence of npm lifecycle hooks does not mitigate execution on normal...

This is a concrete import-time remote-code-execution chain unrelated to the package's stated base-URL wrapper function. The absence of an npm lifecycle hook does not mitigate execution wh...

This is a concrete import-time remote payload execution chain unrelated to the declared money-format interface. The lack of an install hook does not mitigate arbitrary execution whenever...

The malicious loader is import-reachable and performs unverified remote payload execution without user consent. Lack of npm lifecycle hooks does not mitigate runtime compromise.

The benign-looking exported API is a wrapper around import-time remote payload execution. The telemetry file contains the same downloader/runner pattern but is not needed to establish the...

This is an import-time remote code execution chain unrelated to the stated API-client purpose. The lack of an npm lifecycle hook does not mitigate execution on ordinary package import.

The package's advertised adapter entrypoint has no legitimate need to silently retrieve and execute opaque remote binaries. The executable chain is directly reachable on import and is con...

This is a concrete import-time remote payload execution chain, not telemetry. The large telemetry file contains the same payload-hosting primitive, while _bridge.js makes it immediately r...

This is an import-time staged remote-code-execution chain unrelated to the advertised API client wrapper. The lack of lifecycle hooks does not mitigate execution on ordinary package import.