Note: This report is updated by a verification record
Malicious package detected. Executes code during installation via preinstall script in package.json and has only one version published.
The package is marked as malware by OSV: MAL-2026-1387 with source: ghsa-malware
Note: This report is updated by a verification record
The package tahoe-tap version 99.1.15 is likely a malware. The package.json file contains a preinstall script that executes node index.js. This allows arbitrary code execution at install time. The package has only one published version, which raises suspicion. The combination of these factors suggests malicious intent.
