npm malware reports, with evidence.

The manifest contains a concrete automatic install-time remote payload execution and cron persistence chain. The minimal runtime module does not justify this behavior.

Source inspection confirms an automatic install hook that fetches and executes a remote payload, then establishes cron persistence. This is concrete malicious install-hook abuse.

This package performs unconsented remote code execution during preinstall and persists it through cron. This is concrete malware behavior, not a logging feature.

Direct source inspection confirms an automatic install hook that executes an unverified remote script and creates cron persistence. The benign-looking runtime stub does not mitigate this...

This is concrete unconsented install-time remote code execution with persistence. The harmless runtime stub does not mitigate the lifecycle attack.

The package performs unconsented install-time host fingerprinting and external transmission. Its empty runtime code does not justify that behavior.

OpenSSF Malicious Packages via OSV confirms 3layerdipstackx26ujd@0.1.4 as malicious (MAL-2026-14978): Malicious code in 3layerdipstackx26ujd (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstacksu99cs@0.1.4 as malicious (MAL-2026-14923): Malicious code in 3layerdipstacksu99cs (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackyqrxdf@0.1.4 as malicious (MAL-2026-14991): Malicious code in 3layerdipstackyqrxdf (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackpd83be@0.1.4 as malicious (MAL-2026-14873): Malicious code in 3layerdipstackpd83be (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackpsq4vf@0.1.4 as malicious (MAL-2026-14880): Malicious code in 3layerdipstackpsq4vf (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackvhbhs6@0.1.4 as malicious (MAL-2026-14961): Malicious code in 3layerdipstackvhbhs6 (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackposh4n@0.1.4 as malicious (MAL-2026-14879): Malicious code in 3layerdipstackposh4n (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackm7yxnp@0.1.4 as malicious (MAL-2026-14828): Malicious code in 3layerdipstackm7yxnp (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackoi4dda@0.1.4 as malicious (MAL-2026-14858): Malicious code in 3layerdipstackoi4dda (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackoo3m1u@0.1.4 as malicious (MAL-2026-14863): Malicious code in 3layerdipstackoo3m1u (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackrh52pp@0.1.4 as malicious (MAL-2026-14906): Malicious code in 3layerdipstackrh52pp (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstackq6h8eq@0.1.4 as malicious (MAL-2026-14886): Malicious code in 3layerdipstackq6h8eq (npm)

OpenSSF Malicious Packages via OSV confirms hydration-ui-dlx@1.0.0 as malicious (MAL-2026-14577): Malicious code in hydration-ui-dlx (npm)

OpenSSF Malicious Packages via OSV confirms 3layerdipstacknwgnpw@0.1.4 as malicious (MAL-2026-14850): Malicious code in 3layerdipstacknwgnpw (npm)