npm security reports, with evidence.

The lifecycle behavior meets the block boundary: postinstall automatically mutates persistent Claude Code and other AI-tool control/configuration surfaces. Opt-in harvest networking does...

The lifecycle hook directly performs broad foreign AI-agent registration and instruction-file mutation without an explicit user command. This meets the install-control-surface block crite...

Direct source inspection confirms an automatic install-time secret-harvesting and exfiltration chain. This is concrete malicious behavior, not a package-aligned network use.

Direct source inspection confirms an automatic install-time credential and wallet-file exfiltration chain. This is concrete malicious behavior, not a noisy static signal.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, coupled to baked remote egress and transcript collection. Consent governs capture only after the...

Direct source inspection confirms the lifecycle hook performs broad AI-agent configuration and instruction changes automatically. This meets the blocking policy regardless of the absence...

Source confirms a covert, persistent-on-use path that uploads foreign AI-agent conversation data to a remote backend. The absence of install hooks does not mitigate this concrete unprompt...

Direct source inspection confirms a concrete broad AI-agent control-surface mutation chain triggered automatically by npm postinstall. This meets the blocking policy regardless of the pac...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, with a baked remote collector and persistence. Consent is requested only after setup, so it does no...

The math API is a thin JavaScript façade, while import-time execution launches a bundled backdoor unrelated to its stated purpose. This is concrete malicious behavior, not a benign native...

Source directly confirms install-time remote native payload delivery and deliberate security-warning bypass. Digest checking does not negate the package-authored payload or the evasion be...

This is concrete, unconsented postinstall mutation of foreign and broad AI-agent configuration/control surfaces. The absence of exfiltration does not mitigate the automatic cross-agent pe...

OpenSSF/OSV malware advisory MAL-2026-12224 blocks this version. dist/index.js appends `eval(atob('...'))` after the legitimate CSS-plugin export, so simply importing or requiring the pac...

OpenSSF/OSV malware advisory MAL-2026-12027 blocks this version. tailwind-anime@1.1.0 is a typosquat of tailwindcss-animate. Its index.js appends an eval(atob('...')) blob that runs whene...

OpenSSF/OSV malware advisory MAL-2026-12217 blocks this version. index.js appends a large base64-encoded, unicode-escaped payload after ~11 KB of whitespace padding, executed via eval(ato...

OpenSSF/OSV malware advisory MAL-2026-12216 blocks this version. stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and uncondit...

OpenSSF/OSV malware advisory MAL-2026-12267 blocks this version. On require() of the package's main index.js, _loader.js selects a platform-specific endpoint and fetches an opaque native...

OpenSSF/OSV malware advisory MAL-2026-12286 blocks this version. On require of the package, index.js loads _bridge.js which selects a platform-specific payload path, fetches bytes over HT...

OpenSSF/OSV malware advisory MAL-2026-12254 blocks this version. Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./_init on load...

OpenSSF/OSV malware advisory MAL-2026-12238 blocks this version. The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require(), index.js loads _shim.js,...

OpenSSF/OSV malware advisory MAL-2026-12301 blocks this version. index.js unconditionally requires./_init on module load. _init.js assembles host names at runtime via array join to hide t...