npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14073 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14074 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

The package is a concealed remote redirect loader disguised as a security-verification page. Although it has no npm lifecycle hook, its shipped runtime behavior is concrete and malicious.

The package contains no usable library code; its only executable artifact is an obfuscated, server-directed redirector hidden behind a Cloudflare-style challenge. No install hook is neede...

This is concrete concealed browser redirection behavior, not a package-aligned web component. No npm lifecycle hook is required because the declared main artifact is the malicious HTML page.

This is concrete, automatic runtime account manipulation and telemetry rather than a package-aligned messaging feature invoked by the user. The benign preinstall check does not mitigate t...

Source establishes a concrete stealth, persistence, capture, and remote-submission chain aimed at defeating proctoring. The inert cookie extractor further reinforces malicious intent, tho...

This is a concrete stealth, persistence, capture, and external-submission chain, not a diagnostic utility. The benign postinstall hook does not mitigate the malicious user-executed behavior.

OpenSSF/OSV malware advisory MAL-2025-49362 blocks this version. At CLI startup, index.js downloads three native shared libraries (sbx.so, bot.so, v1.so) from https://${arch}.31888.xyz/ (...

This is concrete, auto-starting cryptomining behavior in the published runtime entrypoint, not merely a suspicious primitive. The absence of install hooks does not mitigate runtime harm t...

This package is a deceptive, automatically activated browser cryptominer rather than the advertised common utility package. The lack of install hooks does not mitigate the runtime attack.