npm security reports, with evidence.

This is concrete import-time remote payload execution, not legitimate utility behavior. The lack of an npm lifecycle hook does not mitigate runtime execution on require.

This is a concrete import-time remote code execution chain unrelated to the stated pluggable owners interface. Absence of npm lifecycle hooks does not mitigate execution when consumers im...

This is a concrete import-time staged-payload execution chain unrelated to the documented header library. The absence of an npm lifecycle hook does not mitigate arbitrary execution when c...

This is an import-time staged native payload execution chain unrelated to the package’s stated framework purpose. The absence of an npm lifecycle hook does not mitigate execution on norma...

This is concrete import-time remote payload staging and execution, with obfuscated fallback infrastructure and throttling. Absence of an npm lifecycle hook does not mitigate the reachable...

This is a concrete import-time remote payload execution chain unrelated to the package's documented menu API. The package is malicious even though it has no npm lifecycle hook.

The import-time loader provides a concrete, unconsented remote payload execution chain. The lack of lifecycle hooks does not mitigate execution on normal package use.

The package’s advertised authentication API has no legitimate need for an import-time, unverified remote binary downloader and detached executor. This is a concrete arbitrary-code executi...

OpenSSF/OSV malware advisory MAL-2026-13122 blocks this version. On require('bpm-ng-security'), index.js loads _bridge.js whose top-level bootstrap fetches a platform-specific binary from...

OpenSSF/OSV malware advisory MAL-2026-13121 blocks this version. On require() of the package, index.js loads _bridge.js, which reconstructs Cloudflare Workers hostnames from split string...

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

This is a concrete import-time remote payload execution chain unrelated to a pagination component. Lack of lifecycle hooks does not mitigate the reachable runtime execution.

This is an import-time staged payload launcher unrelated to the declared UI package. The concrete download, drop, permission change, and detached execution chain warrants blocking.

The source establishes an import-time staged payload chain ending in detached execution of unauthenticated remote bytes. Lack of npm lifecycle hooks does not mitigate this runtime RCE path.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI package purpose. Absence of lifecycle scripts does not mitigate execution on normal use.

Source directly confirms an import-triggered remote binary downloader and detached launcher; the lack of an npm lifecycle hook does not mitigate runtime import execution.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: fetched executable bytes are launched without validation. Lack of an install hook does not mitigate the...

The remote payload is not authenticated and is immediately executed on ordinary package import. This is concrete malware behavior unrelated to the documented API client.

Source inspection confirms import-time remote binary staging and execution. No user action, explicit configuration, or lifecycle hook is required beyond loading the package.