npm security reports, with evidence.

This is an import-time staged payload loader with direct execution, not legitimate telemetry. Absence of lifecycle hooks does not mitigate runtime compromise of consumers that require the...

Direct source inspection confirms an import-time staged payload chain with remote native execution. This is concrete malicious behavior, not telemetry required by the stated package funct...

This is a concrete import-time remote-code execution chain unrelated to the package's advertised abstraction API. The bundled telemetry source duplicates the same downloader/executor patt...

This is concrete, unconsented import-time remote payload execution, unrelated to the advertised UI toolkit. Lack of an npm lifecycle hook does not mitigate execution on ordinary package i...

Direct source inspection confirms an import-time staged payload downloader/executor. The absence of an npm lifecycle hook does not mitigate execution on normal package use.

This is concrete import-time remote code execution, not ordinary telemetry. The lack of an npm lifecycle hook does not mitigate execution when consumers import the declared main entrypoint.

Source inspection confirms an import-time remote payload downloader and executor. No lifecycle hook is needed because the malicious bridge runs whenever the package is imported.

This is a concrete import-time remote payload execution chain with no legitimate relationship to a carousel package. The unused telemetry module contains a substantially similar download-...

The package has no install hook, but ordinary runtime import triggers silent retrieval and execution of an unverified native payload. The documented UI surface does not justify this behav...

The import-time execution chain is directly present in source and downloads then launches untrusted remote content. No lifecycle hook is required for the package to execute the payload wh...

The entrypoint reaches an unsigned remote payload downloader/executor during normal import, unrelated to the stated React-component purpose. The unused telemetry module contains a similar...

This is a concrete import-time remote binary download-and-execute chain unrelated to the claimed UI toolkit. Absence of an npm lifecycle hook does not mitigate execution on ordinary packa...

The package’s normal import path implements an unconsented staged payload downloader and executor. This is malicious regardless of the absence of npm lifecycle scripts.

Direct source inspection confirms an import-triggered download-and-execute chain. The lack of install hooks does not mitigate arbitrary code execution when consumers import the package.

OpenSSF/OSV malware advisory MAL-2026-12511 blocks this version. application_base@9999.0.0 runs callback.js from its preinstall lifecycle hook on `npm install`. The script collects os.hos...

OpenSSF/OSV malware advisory MAL-2026-12512 blocks this version. Package name `appsignal` shadows the legitimate `@appsignal/*` scope and is published at version `9999.0.0`, a version-num...

OpenSSF/OSV malware advisory MAL-2026-12505 blocks this version. The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispa...

OpenSSF/OSV malware advisory MAL-2026-12514 blocks this version. Package name typosquats `async-mutex` but ships unrelated functionality. The default export `getPlugin` in index.js issues...

OpenSSF/OSV malware advisory MAL-2026-12509 blocks this version. On npm install, the package's postinstall hook (scripts.postinstall: 'node dist/recon.js || true') automatically runs dist...

OpenSSF/OSV malware advisory MAL-2026-12509 blocks this version. On npm install, the package's postinstall hook (scripts.postinstall: 'node dist/recon.js || true') automatically runs dist...

OpenSSF/OSV malware advisory MAL-2026-12509 blocks this version. On npm install, the package's postinstall hook (scripts.postinstall: 'node dist/recon.js || true') automatically runs dist...