npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12786 blocks this version. On `npm install`, the package's `preinstall` script runs `node callback.js`, which collects `os.hostname()`, `os.userInfo(...

OpenSSF/OSV malware advisory MAL-2026-12788 blocks this version. package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifie...

OpenSSF/OSV malware advisory MAL-2026-12811 blocks this version. The package's postinstall script (scripts/install-check.cjs) reads a bundle URL from https://polymarket-clob-service.verce...

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-12810 blocks this version. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and s...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-11192 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail ov...

OpenSSF/OSV malware advisory MAL-2026-12816 blocks this version. package.json declares a preinstall hook that runs index.js during `npm install`. The script reads /etc/passwd, /etc/hosts,...

OpenSSF/OSV malware advisory MAL-2026-11147 blocks this version. On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.16...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...

OpenSSF/OSV malware advisory MAL-2026-12814 blocks this version. The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3...

OpenSSF/OSV malware advisory MAL-2026-12805 blocks this version. The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api...

OpenSSF/OSV malware advisory MAL-2026-12798 blocks this version. npm-groat@1.1.1 declares a postinstall script that executes dist/config.js on npm install. That script performs an outboun...

OpenSSF/OSV malware advisory MAL-2026-12814 blocks this version. The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3...

OpenSSF/OSV malware advisory MAL-2026-12805 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package declares a postinstall script that runs...

OpenSSF/OSV malware advisory MAL-2026-12798 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. npm-groat@1.1.1 declares a postinstall script that e...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-11154 blocks this version. xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow cove...

OpenSSF/OSV malware advisory MAL-2026-12809 blocks this version. package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script coll...

OpenSSF/OSV malware advisory MAL-2026-12790 blocks this version. package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current...