npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

OpenSSF/OSV malware advisory MAL-2026-12314 blocks this version. install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript wit...

The malicious chain is source-confirmed and import-triggered; the absence of an npm lifecycle hook does not mitigate it. Remote payload execution is concealed behind a benign package entr...

Direct source inspection confirms automatic install-time credential/environment harvesting and external exfiltration. This is concrete malicious behavior.

This is a concrete import-time staged payload loader and executor, unrelated to the advertised UI toolkit. The absence of install hooks does not mitigate runtime arbitrary code execution...

The import-time remote binary drop-and-execute chain is concrete and unrelated to the package's stated UI purpose. Absence of lifecycle hooks does not mitigate execution on normal import.

This is a concrete import-time remote payload execution chain unrelated to the declared UI-grid functionality. The absence of lifecycle hooks does not mitigate execution on ordinary packa...

This is a concrete import-time remote-code-execution chain unrelated to the advertised UI input package. The duplicated telemetry implementation contains the same downloader pattern but i...

The package has a concrete import-time remote-code-execution chain unrelated to its declared UI-icon purpose. The elaborate telemetry module duplicates the same payload-loader pattern but...

This is a concrete import-time staged-payload execution chain unrelated to the advertised UI toolkit. It enables an attacker controlling the endpoints or DNS records to execute arbitrary...

This is a concrete import-time staged-payload loader with detached execution, not telemetry. Absence of an npm lifecycle hook does not mitigate runtime compromise on normal import.

The package's public entrypoint automatically executes a concealed downloader and detached payload launcher. The behavior is concrete, reachable on import, and unrelated to the stated pic...

This is concrete import-time remote payload staging and execution, disguised as telemetry compatibility code. No lifecycle hook is needed for the attack to reach consumers.

Direct source inspection confirms import-time remote payload retrieval and execution, not merely telemetry behavior. No lifecycle hook is needed because the declared main entrypoint activ...