@qwen-code/qwen-code

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Script: node postinstall.js

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/bundled/loop/loop-task-file.test.ts#L400 398 | it('skips a home loop.md whose symlink target escapes $HOME', async () => { 399 | // Home symlinks are allowed (dotfiles repos), but only if they resolve > 400 | // WITHIN $HOME. A `~/.qwen/loop.md -> /etc/passwd`-style escape (here a 401 | // sibling outside homeDir) must be skipped, not read and fed to the model. 402 | await fs.mkdir(path.join(homeDir, '.qwen'), { recursive: true });

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/bundled/loop/loop-task-file.ts#L36 34 | /** 35 | * Confinement root for the home candidate's resolved (symlink-followed) > 36 | * target — a target escaping this dir (e.g. `-> /etc/passwd`) is refused while 37 | * an in-root dotfile symlink is followed. Pass `$QWEN_HOME` when set, else 38 | * `$HOME` (see `homeQwenDir`).

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/bundled/loop/loop-task-file.ts#L185 183 | * the resolved target must be a regular file AND stay within the home 184 | * confinement root (`homeDir`: `$QWEN_HOME` or `$HOME`) so a FIFO/device/dir > 185 | * can't hang the tick and an escaping symlink (e.g. `-> /etc/passwd`) can't be 186 | * exfiltrated. 187 | */

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/bundled/loop/loop-task-file.ts#L279 277 | } 278 | // A home symlink IS followed, but its target must stay WITHIN $HOME: > 279 | // otherwise `~/.qwen/loop.md -> /etc/passwd` (or `-> /dev/...`) would be 280 | // read and fed to the model every tick. In-home dotfile symlinks (e.g. 281 | // `-> ~/dotfiles/loop.md`) still resolve inside $HOME and are allowed.

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/channel-worker-supervisor-A74FV522.js#L86 84 | __name(hasObservedExit, "hasObservedExit"); 85 | function createWorkerEnv(opts) { > 86 | const env = { ...process.env }; 87 | env["QWEN_CODE_NO_RELAUNCH"] = "true"; 88 | env[CHANNEL_DAEMON_WORKER_SENTINEL] = randomUUID();

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-22IFUCVR.js#L134 132 | const execOptions = { 133 | // Don't inherit parent's environment to avoid potential issues > 134 | env: { 135 | ...process.env, 136 | // Ensure we're not in a shell that might interpret special characters

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-22IFUCVR.js#L177 175 | async function launchDetached(command, args) { 176 | const spawnOptions = { > 177 | env: { 178 | ...process.env, 179 | SHELL: void 0

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-6CIIP6OE.js#L105 103 | __name(safeProxyValue, "safeProxyValue"); 104 | function buildEnvStatusFromProcess(workspaceCwd, acpChannelLive) { > 105 | const env = { ...process.env }; 106 | const cells = []; 107 | const runtime = detectRuntime();

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-DQ74W65K.js#L7683 7681 | __name(getMermaidRenderTimeout, "getMermaidRenderTimeout"); 7682 | function createRendererChildEnv(env) { > 7683 | const sourceEnv = { ...process.env, ...env }; 7684 | const childEnv = {}; 7685 | for (const key of RENDERER_ENV_ALLOWLIST) {

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-HI55Z6PR.js#L123 121 | cwd, 122 | stdio: ["pipe", "pipe", "pipe"], > 123 | env: { ...process.env }, 124 | shell: false 125 | });

DLL injection API detected — potential process injection attack Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-MKHC4BYZ.js#L3882 3880 | "NODE_PATH", 3881 | "NODE_TLS_REJECT_UNAUTHORIZED", > 3882 | "LD_PRELOAD", 3883 | "LD_AUDIT", 3884 | "LD_LIBRARY_PATH",

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-ZXCVPMIK.js#L5895 5893 | ); 5894 | fs5.writeFileSync(scriptPath, script); > 5895 | spawn2("cmd.exe", ["/c", scriptPath], { 5896 | detached: true, 5897 | stdio: "ignore",

Silent detached process — runs invisibly in the background (reverse shells, miners) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/chunk-ZXCVPMIK.js#L5895 5893 | ); 5894 | fs5.writeFileSync(scriptPath, script); > 5895 | spawn2("cmd.exe", ["/c", scriptPath], { 5896 | detached: true, 5897 | stdio: "ignore",

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/computer-use-VWN5HH6A.js#L278 276 | args: ["mcp"], 277 | // Inherit env so HTTPS_PROXY / cua-driver config env flow through. > 278 | env: { ...process.env } 279 | }); 280 | const client = new Client(

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/dist-TAVAGZU6.js#L1528 1526 | } 1527 | /** > 1528 | * Context-aware alias for `api.getFile`. Use this method to get basic info about a file and prepare it for downlo 1529 | * 1530 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type

URL pointing to known exfiltration/tunneling service Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/dist-TAVAGZU6.js#L3924 3922 | } 3923 | }; > 3924 | const apiRoot = (_a = options.apiRoot) !== null && _a !== void 0 ? _a : "https://api.telegram.org"; 3925 | const environment = (_b = options.environment) !== null && _b !== void 0 ? _b : "prod"; 3926 | const { fetch: customFetch } = options;

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/dist-TAVAGZU6.js#L4679 4677 | } 4678 | /** > 4679 | * Use this method to get basic info about a file and prepare it for downloading. For the moment, bots can downloa 4680 | * 4681 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type

URL pointing to known exfiltration/tunneling service Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/dist-TAVAGZU6.js#L9709 9707 | } 9708 | getFileUrl(filePath) { > 9709 | return `https://api.telegram.org/file/bot${this.bot.token}/${filePath}`; 9710 | } 9711 | async connect() {

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/gemini-F3IERB37.js#L919 917 | ...scriptArgs 918 | ]; > 919 | const newEnv = { ...process.env, QWEN_CODE_NO_RELAUNCH: "true" }; 920 | process.stdin.pause(); 921 | const child = spawn(process.execPath, nodeArgs, {

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/gemini-F3IERB37.js#L1189 1187 | let proxyProcess2 = void 0; 1188 | let sandboxProcess2 = void 0; > 1189 | const sandboxEnv = { ...process.env }; 1190 | if (proxyCommand2) { 1191 | const proxy = process.env["HTTPS_PROXY"] || process.env["https_proxy"] || process.env["HTTP_PROXY"] || process.env

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/gemini-F3IERB37.js#L1273 1271 | { 1272 | stdio: "inherit", > 1273 | env: { 1274 | ...process.env, 1275 | QWEN_SANDBOX: config.command

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/monitor-ARL5P45R.js#L284 282 | stdio: ["ignore", "pipe", "pipe"], 283 | detached: true, > 284 | env: { 285 | ...process.env, 286 | QWEN_CODE: "1",

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/chunks/server-4AGEK2HC.js#L15768 15766 | // over process.env like packages/core/src/tools/mcp-client.ts does; when 15767 | // unset, let the SDK apply its safe default environment. > 15768 | ...cfg.env ? { env: { ...process.env, ...cfg.env } } : {}, 15769 | cwd: cfg.cwd 15770 | });

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/web-shell/assets/bat-fje9CFhw.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns": 2 |

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/web-shell/assets/bat-fje9CFhw.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns": 2 |

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/QwenLM/qwen-code/blob/e362808b11e8f918a2c4f6f7305d436ee397b688/web-shell/assets/bat-fje9CFhw.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns": 2 |

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (yiliang114) than the most recent previously approved version (tanzhenxin) on 2026-07-01, but yiliang114 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-27, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-23, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-17, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-16, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-16, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-13, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-12, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-11, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-09, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-03-03, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-28, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-24, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-18, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-18, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-16, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-14, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-11, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-09, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-05, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-02-03, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-30, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-27, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-27, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-20, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-14, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-14, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-12, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2026-01-07, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2025-12-26, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2025-12-22, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2025-12-19, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2025-12-13, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (tanzhenxin) than the most recent previously approved version (ranpox) on 2025-12-12, but tanzhenxin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.