npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12405 blocks this version. On npm install, postinstall.mjs enumerates platform-specific sibling package names of the form opencode-engos-<platform>-<...

This is a concrete import-time remote payload execution chain unrelated to a pagination component. Lack of lifecycle hooks does not mitigate the reachable runtime execution.

This is an import-time staged payload launcher unrelated to the declared UI package. The concrete download, drop, permission change, and detached execution chain warrants blocking.

The source establishes an import-time staged payload chain ending in detached execution of unauthenticated remote bytes. Lack of npm lifecycle hooks does not mitigate this runtime RCE path.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI package purpose. Absence of lifecycle scripts does not mitigate execution on normal use.

Source directly confirms an import-triggered remote binary downloader and detached launcher; the lack of an npm lifecycle hook does not mitigate runtime import execution.

This is a concrete import-time remote-code-execution chain, not ordinary telemetry: fetched executable bytes are launched without validation. Lack of an install hook does not mitigate the...

The remote payload is not authenticated and is immediately executed on ordinary package import. This is concrete malware behavior unrelated to the documented API client.

Source inspection confirms import-time remote binary staging and execution. No user action, explicit configuration, or lifecycle hook is required beyond loading the package.

This is a concrete, import-triggered remote native payload execution chain unrelated to the advertised widget. The duplicate telemetry implementation corroborates the same downloader/laun...

The advertised interceptor has no functional connection to hidden import-time remote executable delivery. This is a concrete remote-code-execution chain, not merely telemetry behavior.

This is a concrete staged payload chain reachable on ordinary import, not a configured telemetry feature. No lifecycle hook is needed because the malicious action runs from the main entry...

The import-time downloader/executor is concrete, stealthy, and unrelated to the package's stated visual-components purpose. The separate telemetry source contains the same remote-extensio...

The package has no install hook, but its normal import path executes a concealed downloader and launcher. The telemetry file independently implements the same payload-delivery pattern.

The advertised feature-toggle entrypoint has no need for an import-time remote binary bootstrap. The concrete downloader-to-temp-file-to-detached-execution chain is malicious.

This is a concrete, automatically reachable remote binary staging and execution chain concealed behind an unrelated DI package API. The absence of lifecycle scripts does not mitigate impo...

Direct source inspection confirms an import-time staged-payload downloader and detached executor, not merely telemetry transport. The lack of lifecycle hooks does not mitigate execution o...

The package's documented auth API is unrelated to its import-time remote binary loader. No lifecycle script is needed because ordinary package import triggers the execution chain.

This is a concrete import-time remote code execution chain, not legitimate telemetry. The large telemetry module contains a parallel implementation, reinforcing deliberate payload-loader...

This is a concrete import-time staged payload execution chain unrelated to the advertised cobrowsing interface. The lack of install hooks does not mitigate execution when consumers import...

This is a concrete import-time remote-code-execution chain, not ordinary telemetry. The included telemetry module independently contains the same remote native-loader pattern.