Note: This report is updated by a verification record
The package contains a preinstall script executing node index.js, flagged by YARA and LLM, suggesting it's likely malware.
The package is marked as malware by OSV: MAL-2026-1385 with source: ghsa-malware
Note: This report is updated by a verification record
The package contains a preinstall script that executes node index.js. This is flagged by both YARA and LLM analysis. The preinstall script is a common method for malware to execute arbitrary code upon installation. The low confidence of the YARA rule is mitigated by the LLM analysis which indicates medium confidence of malicious behavior. The combination of these two findings suggests that the package is likely malware.
