OpenSSF/OSV advisory MAL-2026-12501 confirms this npm version as malicious. The package declares a preinstall script (node index.js) that, on Windows, spawns a hidden PowerShell window (-WindowStyle Hidden) to fetch https://files.catbox.moe/5khq55.zip, extract it to %TEMP%, and execute Verification_Tool.exe. The fetched binary is unpinned, unhashed, and hosted on an anonymous file-drop service unrelated to the package's stated purpose...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in william-data-formatter-x (npm)
Details
The package declares a preinstall script (node index.js) that, on Windows, spawns a hidden PowerShell window (-WindowStyle Hidden) to fetch https://files.catbox.moe/5khq55.zip, extract it to %TEMP%, and execute Verification_Tool.exe. The fetched binary is unpinned, unhashed, and hosted on an anonymous file-drop service unrelated to the package's stated purpose. The package name has a leading space (' william-data-formatter-x') and carries generic 'Internal sync utility' / 'IT Operations' metadata consistent with social-engineering framing. Installing this package on a Windows machine results in arbitrary attacker-controlled code executing on the installer's host at npm install time.
Decision reason
OpenSSF Malicious Packages via OSV confirms william-data-formatter-x@1.0.0 as malicious (MAL-2026-12501): Malicious code in william-data-formatter-x (npm)