npm security reports, with evidence.

The source establishes concrete import-time remote code execution, not merely telemetry behavior. No lifecycle hook is needed because the main entrypoint triggers it for package consumers.

This is a concrete import-time remote payload execution chain unrelated to the advertised UI toolkit. The absence of lifecycle hooks does not mitigate arbitrary code execution on normal p...

Source establishes a concrete import-time remote payload staging and execution chain, unrelated to the declared UI package. The absence of lifecycle hooks does not mitigate execution on n...

Source inspection confirms an import-time staged binary loader and detached execution chain. No benign package function requires this behavior.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI-label functionality. Absence of npm lifecycle hooks does not mitigate the automatic entrypoint trig...

Concrete import-time download-and-execute behavior establishes malicious remote code execution. The lack of lifecycle hooks does not mitigate the reachable import-time trigger.

This is a concrete import-time remote payload execution chain, not merely telemetry or an optional user action. The lack of lifecycle scripts does not mitigate execution on normal package...

This is concrete import-time remote payload execution unrelated to the advertised UI mixins package. The dormant telemetry module repeats the same downloader/launcher pattern, reinforcing...

Source inspection confirms an import-time remote payload downloader and detached executor; the benign UI API does not use or justify this behavior.

The concrete import-time downloader, DNS fallback, payload drop, and detached execution establish malicious behavior independent of scanner labels. The visible logger API does not require...

This is a concrete import-time remote payload execution chain unrelated to the advertised schema-validation package. The absence of lifecycle hooks does not mitigate execution when consum...

The reachable import-time loader executes opaque remotely controlled binaries without user action or package-aligned purpose. Absence of lifecycle hooks does not mitigate the import-time...

This is a concrete import-time downloader-and-executor chain unrelated to the stated UI addon purpose. No installation hook is needed because normal package import activates it.

This is concrete import-time remote code execution unrelated to the package's stated UI purpose. The lack of integrity verification and detached execution make the network-controlled payl...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12488 blocks this version. The package's `tt-help watchdog` subcommand starts a long-running agent that POSTs heartbeats to a remote server (default...

OpenSSF/OSV malware advisory MAL-2026-12437 blocks this version. dist/cjs/index.js appends an eval(atob(...)) blob to what appears to be a React Button re-export. The decoded payload quer...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...

OpenSSF/OSV malware advisory MAL-2026-12028 blocks this version. The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main,...