OpenSSF/OSV advisory MAL-2026-14277 confirms this npm version as malicious. The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a top-level side effect (line 27). Loading the module via require/import causes an unprompted PowerShell process to launch on the installer's machine, which is a Windows-focused code execution vector wholly unrelated to any legitimate library function...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in o0o9 (npm)
Details
The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a top-level side effect (line 27). Loading the module via require/import causes an unprompted PowerShell process to launch on the installer's machine, which is a Windows-focused code execution vector wholly unrelated to any legitimate library function. This is the shape of an install/import-time execution payload rather than an API a caller must opt into.
Decision reason
OpenSSF Malicious Packages via OSV confirms o0o9@2.0.1 as malicious (MAL-2026-14277): Malicious code in o0o9 (npm)