This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.
Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.
Aikido reported compromised releases across a widely used group of npm packages. The injected browser code attempted to redirect cryptocurrency transactions to attacker-controlled destinations.
Affected versions: Affected releases differ by package; see the original report.
OpenSSF Scorecard — 4.6 / 10 on 2026-08-24. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.
Third-party facts checked 30 days ago; registry facts on every crawl.
State history 1
When
Change
2026-11-05
first verdict: active
Supply-chain history 1
account hijacked2025-09
Its maintainer was phished and versions with a crypto-clipboard payload were live for a few hours, in the same incident across several packages from one account.
Malicious versions were removed within hours; the exposure window was short.
Source: npm phishing incident reporting, 8 September 2025. History, not a warning about today — the verdict above is about maintenance now.
Badge
Drop this in your README. It re-renders itself as the verdict changes.
