npm security reports, with evidence.

Direct source inspection confirms an import-time staged-payload loader with silent detached execution. The absence of an npm lifecycle hook does not mitigate the reachable runtime attack.

Source inspection confirms an automatic, obfuscated download-and-execute chain reachable on normal import. The lack of an install hook does not mitigate import-time arbitrary payload exec...

This is a concrete import-time remote download-and-execute chain unrelated to the stated Svelte adapter functionality. No lifecycle hook is needed because normal package use triggers it.

This is a concrete import-time remote payload download-and-execute chain unrelated to the stated declaration-generator functionality. The lack of lifecycle hooks does not mitigate executi...

This is concrete import-time staged payload execution with obfuscated endpoints and no payload verification. The absence of lifecycle hooks does not mitigate execution during ordinary pac...

The public entrypoint reaches a concealed remote binary downloader and detached launcher without user action. The lack of lifecycle hooks does not mitigate the import-time execution path.

The documented package role is a configuration loader, but its import path immediately performs covert remote native payload execution. This is concrete malware behavior, not a benign tel...

The import-time loader establishes a concrete remote-payload execution chain. The unused telemetry module contains materially similar downloader/executor logic, reinforcing intent.

The loader is reachable directly from index.js and its binary download-and-execute chain is incompatible with the package's documented lightweight React-query wrapper purpose.

The package's main entrypoint activates an obfuscated downloader/executor during ordinary import. Its fallback channels, temporary persistence marker, hidden errors, and detached executio...

This is an import-time remote payload execution chain unrelated to the tiny advertised REST-client API. Its obfuscation, DNS fallback, hidden temp staging, and detached execution establis...

This is a concrete import-time remote-code-execution chain unrelated to the advertised React hooks API. The absence of lifecycle scripts does not mitigate automatic execution when consume...

OpenSSF/OSV malware advisory MAL-2026-13209 blocks this version. The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespok...

OpenSSF/OSV malware advisory MAL-2026-13210 blocks this version. The package's package.json declares its dependency "@openai/codex" as a direct tarball URL: https://gitcode.com/api/v5/rep...

OpenSSF/OSV malware advisory MAL-2026-13217 blocks this version. akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode var...

OpenSSF/OSV malware advisory MAL-2026-13216 blocks this version. The package hides an executable payload inside a block comment in index.js using Unicode variation selectors (U+FE00–U+FE0...

Source directly establishes an import-time remote payload download and detached execution chain. The lack of an install hook does not mitigate runtime arbitrary code execution when consum...

The package has a concrete, import-time remote-code-execution chain unrelated to its stated mobile SDK API. No install hook is needed for the payload to execute when the module is loaded.

This is a concrete import-time remote-code-execution chain unrelated to the advertised React UI components. Absence of an npm lifecycle hook does not mitigate runtime import execution.

Confirmed source behavior is an import-triggered remote binary downloader and executor, not package-aligned telemetry. The unused/parallel telemetry implementation repeats the same payloa...

The package’s documented wrapper has no legitimate need to execute opaque remote binaries on import. The behavior is concrete, automatic, stealthy, and provides remote code execution.