// npm package
@cloudplatform-single-spa/svp-tasks
security holding package
weekly
110
monthly
110
versions
1
maintainers
1
first publish
2026-05-27
publisher
npm
tarball
482 B
AUTO-PUBLISHED·1 version indexed·latest published 2026-05-28
// publisher campaignby npm
9 caught packages from this accountThis is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.
// offending code· @0.0.1-security.1· no static-pattern hits
llm: benign · 0.85→ No suspicious destination, no remote-exec shape — no network destinations.
- @0.0.1-security.1··AUTO-PUBLISHED·publisher: npmheuristic 92/100static flags 0llm benign (0.85) via ollamanew-publisher:10dtiny-tarball:482bfirst-version-of-packagepublisher-multi-name-burst:117publisher-version-pump:118osv-flagged:MAL-2026-4990
→ No suspicious destination, no remote-exec shape — no network destinations.
// offending code· no static-pattern hits
--- package.json (entry) --- { "name": "@cloudplatform-single-spa/svp-tasks", "version": "0.0.1-security.1", "description": "security holding package", "repository": "npm/security-holder" }