npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14539 blocks this version. The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint...

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-14535 blocks this version. The package's main entry (dist/index.mjs) locates dist/internal/math.mjs, chmods it to 0755, and spawns it as a detached c...

OpenSSF/OSV malware advisory MAL-2026-14531 blocks this version. On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(),...

Source inspection confirms a concrete import-time global install and remote configuration chain unrelated to the advertised testing library. This is malicious dependency behavior.

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-14526 blocks this version. The package's package.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL (h...

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

The package performs a concealed import-time installation of a differently named package into the consuming project, controlled by a remote registry response. No lifecycle hook is needed...

This is concrete, remotely controlled, unconsented account mutation during normal package use. The harmless Node-version preinstall check does not mitigate the runtime behavior.

OpenSSF/OSV malware advisory MAL-2026-14442 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-13456 blocks this version. LPM AI review remains unresolved. santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js l...

Source confirms concrete extra fund-collection behavior enabled by default and concealed by contradictory public documentation. It is not an install hook, but it directly causes unconsent...

OpenSSF/OSV malware advisory MAL-2026-14509 blocks this version. On npm install, the package's postinstall hook runs `node.worker.js`, which detaches a background child, waits a jittered...

OpenSSF/OSV malware advisory MAL-2026-14512 blocks this version. dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes `eval(atob('<~39KB base64>'))` at...

OpenSSF/OSV malware advisory MAL-2026-14491 blocks this version. On module load, lib/initializeCaller.js (required from index.js) runs an IIFE that POSTs the full process.env to a base64-...

OpenSSF/OSV malware advisory MAL-2026-14492 blocks this version. Package is published under a name resembling the legitimate 'spotify-url-info' but its shipped code is an exfiltration too...

OpenSSF/OSV malware advisory MAL-2026-14487 blocks this version. On require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules ev...