// npm package
@mlspace/dtransfer
security holding package
weekly
108
monthly
108
versions
1
maintainers
1
first publish
2026-05-27
publisher
npm
tarball
446 B
AUTO-PUBLISHED·1 version indexed·latest published 2026-05-28
// publisher campaignby npm
9 caught packages from this accountThis is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.
// offending code· @0.0.1-security· no static-pattern hits
llm: benign · 0.85→ No suspicious destination, no remote-exec shape — no network destinations.
- @0.0.1-security··AUTO-PUBLISHED·publisher: npmheuristic 92/100static flags 0llm benign (0.85) via ollamanew-publisher:10dtiny-tarball:446bfirst-version-of-packagepublisher-multi-name-burst:117publisher-version-pump:118osv-flagged:MAL-2026-5013
→ No suspicious destination, no remote-exec shape — no network destinations.
// offending code· no static-pattern hits
--- package.json (entry) --- { "name": "@mlspace/dtransfer", "version": "0.0.1-security", "description": "security holding package", "repository": "npm/security-holder" }