[email protected]

[email protected] published to npm, flagged by codelake scanners on 2026-09-10 05:40 UTC.

Detector rules that fired on this package:

• Dependency 'GITHUB-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'bare-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'bitbucket-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'dev-git' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'dev-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'dev-tarball' is pulled from a non-registry source (url) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'dot' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'dotdot' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'git-plus-file' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'git-plus-http' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'git-plus-https' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'git-plus-ssh' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'git-proto' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'github-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'gitlab-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'opt-git' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'opt-shorthand' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'opt-tarball' is pulled from a non-registry source (url) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'pnpm-portal' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'scp-like' is pulled from a non-registry source (git-shorthand) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'ssh-proto' is pulled from a non-registry source (git) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'tarball-HTTP' is pulled from a non-registry source (tarball) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'tarball-http' is pulled from a non-registry source (insecure-url) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency
• Dependency 'tarball-https' is pulled from a non-registry source (url) — can deliver arbitrary code outside the registry behavior.manifest.non-registry-dependency

OSV reference: MAL-2026-16076

This is an auto-generated entry in the codelake detections feed. Hand-curated deep case studies live on /advisories.