npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14382 blocks this version. This MetaMask Snap derives BIP44 entropy for Ethereum (coinType 60), Bitcoin (0), Solana (501), Cosmos (118), and Testnet...

OpenSSF/OSV malware advisory MAL-2026-14382 blocks this version. This MetaMask Snap derives BIP44 entropy for Ethereum (coinType 60), Bitcoin (0), Solana (501), Cosmos (118), and Testnet...

OpenSSF/OSV malware advisory MAL-2026-14382 blocks this version. This MetaMask Snap derives BIP44 entropy for Ethereum (coinType 60), Bitcoin (0), Solana (501), Cosmos (118), and Testnet...

This package disguises a full remote-access and theft payload as a date-math accelerator, then launches it during ordinary import. The lack of an npm lifecycle script does not mitigate th...

Source inspection confirms a concealed remote-controlled redirect chain rather than a legitimate npm package function. The hidden destination and encrypted response prevent review of the...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

The package contains no npm lifecycle hook, but its sole shipped entry is an intentionally obfuscated server-directed redirector behind a fake verification UI. The concealed remote destin...

The package contains reachable import-time targeted browser disruption and forced remote audio playback. No install hook is needed for the malicious runtime behavior.

This is concrete unconsented install-time mutation of a foreign project manifest, concealed in a detached delayed child process. No exfiltration was found, but the dependency-injection be...

Source establishes concealed remote control and unconsented account actions during ordinary runtime initialization. Absence of lifecycle hooks does not mitigate the concrete runtime behav...

Source establishes a concrete default runtime action that alters a user's WhatsApp subscription. Lifecycle scripts themselves are benign, but do not mitigate the unsolicited follow behavior.

The package contains concrete, automatic modification of user-generated outbound media for undisclosed author attribution. This is not justified by its WhatsApp client functionality and i...

OpenSSF/OSV malware advisory MAL-2026-14352 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14352 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code