Note: This report is updated by a verification record
The package is likely malware due to the presence of a suspicious preinstall script (node index.js) detected by YARA and LLM analysis.
The package is marked as malware by OSV: MAL-2026-1386 with source: ghsa-malware
Note: This report is updated by a verification record
The package contains a preinstall script in package.json that executes node index.js. This is flagged by both a YARA rule (npm_preinstall_command) and an LLM-based file evaluation service as suspicious. Executing code during the installation process is a common technique used by malware to compromise systems. The combination of these two evidences indicates a high likelihood of malicious intent.
