npm security reports, with evidence.

This is a concrete import-time remote payload execution chain, not ordinary telemetry. The package has no install hook, but its normal entrypoint still activates the downloader and launcher.

This is concrete, import-time staged remote-code execution with no legitimate functionality exposed by the package that requires it. The absence of lifecycle hooks does not mitigate runti...

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of npm lifecycle hooks does not mitigate the reachable malicious entrypoint.

This is concrete import-time remote payload execution, unrelated to the package's stated wrapper purpose. No lifecycle hook is needed because requiring the public module activates the chain.

This is concrete automatic remote payload execution unrelated to the documented abstraction API. No install hook is needed because ordinary package import activates the chain.

OpenSSF/OSV malware advisory MAL-2026-10750 blocks this version. The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all refere...

The import-time downloader and detached execution chain is concrete remote code execution, unrelated to the advertised header abstraction. The telemetry-named code repeats the same payloa...

This is a concrete import-time remote-code-execution chain unrelated to the declared UI support module. The absence of npm lifecycle hooks does not mitigate execution on normal package im...

The public import path directly reaches unverified remote binary execution, unrelated to the package’s stated footer abstraction. This is concrete malware behavior, not ordinary telemetry.

This is concrete import-time remote payload execution, not package-aligned telemetry. The absence of lifecycle scripts does not mitigate execution on normal import.

OpenSSF/OSV malware advisory MAL-2026-12767 blocks this version. On require of the package, index.js loads _bridge.js, which assembles platform-specific destination hostnames via string-s...

OpenSSF/OSV malware advisory MAL-2026-12768 blocks this version. index.js unconditionally requires./_loader on load. _loader.js reassembles Cloudflare workers.dev hostnames (oob-worker.cf...

This is a concrete import-time remote-code-execution chain unrelated to the declared UI-wrapper functionality. The lack of install hooks does not mitigate execution on normal package import.

Direct source inspection confirms an import-time remote payload loader and detached execution chain. The absent npm lifecycle hook does not mitigate the runtime compromise.

The import-time downloader and detached execution of unverified remote bytes are concrete malicious behavior, not telemetry. Lack of an npm lifecycle hook does not mitigate the runtime im...

OpenSSF/OSV malware advisory MAL-2026-12781 blocks this version. index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudf...

OpenSSF/OSV malware advisory MAL-2026-12789 blocks this version. The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it...

OpenSSF/OSV malware advisory MAL-2026-12794 blocks this version. The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home d...

OpenSSF/OSV malware advisory MAL-2026-12800 blocks this version. The package's preinstall script runs automatically on `npm install` and collects installer-side identifiers — `os.hostname...

OpenSSF/OSV malware advisory MAL-2026-12804 blocks this version. store-locator-widget@9999.0.0 ships an empty library body (index.js exports `{}`) and a preinstall hook (`node callback.js...

OpenSSF/OSV malware advisory MAL-2026-12801 blocks this version. sc-payment-utils@9999.0.0 declares a preinstall script that executes callback.js on npm install. The script collects host...