npm malware reports, with evidence.

This is a concrete automatic install-time remote code delivery path with certificate verification disabled and no payload integrity check. The postinstall also mutates hidden asset links,...

This package performs concrete, unconsented postinstall persistence and silent software installation on Windows. The behavior is automatic rather than an explicit user setup command.

The package has a concrete automatic lifecycle chain that deletes files and installs remotely obtained skills across multiple AI-agent directories. This meets the install-hook abuse block...

Direct inspection confirms an automatic preinstall hook that fingerprints the host and exfiltrates the values over HTTP. This is concrete malicious install-hook abuse.

The package performs unconsented install-time system mutation and later automatic command execution and external control-surface writes. The absence of observed secret theft does not remo...

This is an automatic lifecycle remote-code delivery chain, not a transparent package-only CLI installation. The downloaded payload is not independently pinned or reviewable, and the packa...

This is unconsented postinstall mutation of a foreign AI-agent control surface, combined with broad deletion in the user's Claude command directory. The automatic native download further...

This is an automatic remote-native-payload bootstrap whose trust decision is controlled by the payload source itself, followed by execution of the resulting binaries. That install-to-exec...

The package performs unconsented install-time mutation of foreign dependency code and removes source maps afterward. This is a concrete install-hook abuse pattern even though the hook its...

The complete lifecycle chain automatically alters global AI-agent configuration and instructions without interactive consent. This meets the install-hook abuse blocking policy even though...

This is an unconsented global npm lifecycle mutation of broad AI-agent command and persistence surfaces, combined with automatic self-updating. It also contains a concrete credential-tran...

This package contains a concealed, default-on action that changes a user's WhatsApp subscriptions during ordinary socket creation. The unrelated phone-number lookup endpoint reinforces th...

The package has a concrete automatic install-time chain that patches another product's runtime files to expose session messages. Its runtime configuration mutation further enables that ex...

This is an obfuscated, remotely controlled redirect hidden behind a verification page, not a legitimate npm package function. Although it has no install hook, opening its declared entrypo...

The automatic postinstall hook broadly mutates a foreign consumer project and installs a plugin that restores overwritten source files. This is concrete install-hook abuse under the state...

This is concrete install-hook abuse: automatic installation rewrites the consuming project's lifecycle configuration and changes agent plugin state. The behavior is persistent and runs wi...

Although its automatic hook only initializes package-owned configuration, the package contains a direct, functional third-party entitlement and gate-bypass capability. That concrete tampe...

This package is a disguised browser redirector with encrypted, server-selected payload delivery. The absence of npm lifecycle hooks does not neutralize the concrete malicious behavior exe...

The package embeds an active service-worker proxy application in an SVG declared as its npm entry point. Its automatic scope-wide request interception and externally configured traffic re...

The public library entry is benign, but the included t.js contains an executable, targeted account-takeover workflow. Its lack of automatic npm execution reduces exposure but does not neu...

This is concrete unconsented install-time persistence across operating systems, reinforced by deliberate process-name evasion. The absence of a self-dependency does not neutralize this li...