npm malware reports, with evidence.

This is concrete, automatic remote-controlled mutation of a user’s WhatsApp account, unrelated to the requested socket connection. The install hook is benign, but does not mitigate the ru...

The automatic remote-controlled modification of a user's WhatsApp account is concrete unauthorized behavior. The lifecycle hook itself is benign, but it does not mitigate the runtime payl...

The package performs concrete privileged persistence and weakens remote-access controls automatically during npm installation. This is malicious behavior, not a benign installer primitive.

The package exports a bundle containing targeted, automatically activated page disruption and external audio playback. Absence of install hooks does not mitigate the runtime attack behavior.

OpenSSF/OSV malware advisory MAL-2025-47009 blocks this version. @magda/semantic-indexer-sdk ships a minified `dist/index.js` bundle for a Magda semantic-indexer SDK. Static keyword patte...

OpenSSF/OSV malware advisory MAL-2026-13920 blocks this version. The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect install...

OpenSSF/OSV malware advisory MAL-2026-13920 blocks this version. The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect install...

OpenSSF/OSV malware advisory MAL-2026-13922 blocks this version. package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home di...

OpenSSF/OSV malware advisory MAL-2026-13923 blocks this version. The package name resembles @tailwindcss/forms and its src/index.js copies the legitimate @tailwindcss/forms source, append...

OpenSSF/OSV malware advisory MAL-2026-13921 blocks this version. envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs wheneve...

OpenSSF/OSV malware advisory MAL-2026-13919 blocks this version. @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script (index.js/callback.js) that executes `id` and `hostname`...

OpenSSF/OSV malware advisory MAL-2026-13918 blocks this version. The package presents itself as an n8n helper node but ships only a stub node (nodes/PwnNode.node.js) and a postinstall scr...

OpenSSF/OSV malware advisory MAL-2026-13917 blocks this version. Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file (nodes/PwnNode.node.js,...

OpenSSF/OSV malware advisory MAL-2026-13916 blocks this version. On `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host...

OpenSSF/OSV malware advisory MAL-2026-13914 blocks this version. The package auto-executes a reconnaissance and exfiltration payload both at install (via scripts.postinstall running callb...

OpenSSF/OSV malware advisory MAL-2026-13913 blocks this version. The package presents as an n8n community-nodes helper but ships a malicious postinstall script (callback.js) and a byte-id...

OpenSSF/OSV malware advisory MAL-2026-13912 blocks this version. The package runs a hostile payload both from its declared postinstall hook (`node callback.js`) and at library load via `i...

OpenSSF/OSV malware advisory MAL-2026-13911 blocks this version. On npm install, callback.js/index.js (invoked from the package's postinstall/main) executes `id` and `hostname`, reads `/e...

OpenSSF/OSV malware advisory MAL-2026-13910 blocks this version. On npm install (postinstall) and on require/import of the package's main entry, callback.js and index.js execute `id`, `ho...

OpenSSF/OSV malware advisory MAL-2026-13909 blocks this version. The package's postinstall script (callback.js) and its main module (index.js, byte-identical to callback.js) execute on bo...