npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-12317 blocks this version. package.json declares a postinstall script `node dist/recon.js || true` that runs automatically on npm install. dist/recon...

OpenSSF/OSV malware advisory MAL-2026-12315 blocks this version. On npm install, the package's postinstall script (dist/recon.js) collects installer-side host reconnaissance — hostname, u...

OpenSSF/OSV malware advisory MAL-2026-12327 blocks this version. On `npm install`, the package's postinstall script (`node index.js`) collects host identifiers (`os.hostname()`, `os.userI...

OpenSSF/OSV malware advisory MAL-2026-12325 blocks this version. On require(), index.js unconditionally calls a telemetry() function at module top level that collects host reconnaissance...

Direct source inspection confirms an import-triggered staged payload downloader and executor. Lack of lifecycle hooks does not mitigate runtime arbitrary code execution.

The package has a concrete import-time remote payload execution chain, not merely telemetry primitives. Absence of lifecycle scripts does not mitigate execution when normal package import...

This is concrete import-time remote payload execution, not legitimate telemetry: the package's public API is inert while the hidden side module downloads and launches an opaque binary.

This is a concrete import-time staged payload downloader and execution chain unrelated to the advertised shared-utilities package. The lack of lifecycle hooks does not mitigate execution...

This is concrete, automatic remote payload execution unrelated to the declared UI-toolkit functionality. The absence of lifecycle hooks does not mitigate the import-time execution path.

This is a confirmed import-time downloader-and-executor, not ordinary telemetry. No lifecycle hook is needed because the package entrypoint activates it.

This is a concrete, import-triggered remote-code-execution chain unrelated to the documented minimal SDK API. The absence of an install hook does not mitigate execution on normal package...

This is concrete, automatic remote-code execution unrelated to the advertised API adapter. The lack of lifecycle hooks does not mitigate import-time execution.

This is an import-time remote payload execution chain unrelated to the stated REST-client purpose. The absence of npm lifecycle hooks does not mitigate the reachable runtime execution.

This is a concrete, automatic remote-payload execution chain unrelated to the advertised types interface. The lack of an npm lifecycle hook does not mitigate import-time execution.

This is a concrete import-time remote payload download and execution chain, not ordinary telemetry. The lack of install hooks does not mitigate execution when an application imports the d...

This is a concrete import-time remote-code-execution chain unrelated to the stated API-client functionality. The lack of lifecycle hooks does not mitigate runtime execution on normal pack...

This is a concrete import-time remote-payload execution chain unrelated to the advertised API adapter. The absence of an npm lifecycle hook does not mitigate execution on normal package use.

This is an import-time staged remote payload execution chain unrelated to the stated REST client wrapper. The absence of lifecycle hooks does not mitigate execution on normal use.

This is a concrete import-time remote-code-execution chain, unrelated to the advertised token manager. No install hook is needed because normal use triggers the payload loader.

The package has concrete import-time remote binary execution unrelated to its advertised mobile-input API. The same payload-loader capability is duplicated in the unexported telemetry sou...

This is a concrete import-time staged native payload execution chain unrelated to the small advertised SDK API. The bundled telemetry module independently contains the same downloader/lau...

The malicious behavior is directly reachable on ordinary package import and executes unauthenticated remote content. No lifecycle hook is needed for the package to compromise an applicati...

This is concrete, unconsented remote native payload execution on import, unrelated to the advertised minimal mobile SDK. The absence of an npm lifecycle hook does not mitigate the reachab...

This is concrete import-time remote binary execution unrelated to the declared native-card wrapper. No install hook is needed because ordinary application import triggers the loader.

This is a concrete import-time remote payload download-and-execute chain unrelated to the package's advertised minimal API. No lifecycle hook is needed because the malicious initializer i...