npm malware reports, with evidence.

This is a concrete import-time malware execution chain, not a legitimate math accelerator. Absence of an npm lifecycle hook does not mitigate execution when the package is imported.

OpenSSF/OSV malware advisory MAL-2026-13761 blocks this version. The tarball contains a 455 KB Windows PE64 executable named DakuMangalSingh.exe (sha256 368320791e5c022ffabedb44eae6ca902f...

This is concrete install-time execution of a bundled surveillance and remote-control payload, not a package-aligned feature. The evidence supports a publish block.

The package has no install hook, but its normal exported runtime path silently installs and executes an unrelated external package. The obfuscation, hidden subprocess output, and dynamic...

OpenSSF/OSV malware advisory MAL-2026-13747 blocks this version. base65-13x@5.0.2 impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decode(...

OpenSSF/OSV malware advisory MAL-2026-13746 blocks this version. The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its home...

OpenSSF/OSV malware advisory MAL-2026-13745 blocks this version. base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints (src/cjs/index.cjs and src/esm/index.js...

OpenSSF/OSV malware advisory MAL-2026-13753 blocks this version. dcfarguscert@999.0.1 registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install,...

OpenSSF/OSV malware advisory MAL-2026-13754 blocks this version. package.json declares `postinstall: node index.js`, causing index.js to run automatically on `npm install`. The script col...

OpenSSF/OSV malware advisory MAL-2026-13752 blocks this version. The package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.host...

OpenSSF/OSV malware advisory MAL-2026-13744 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package's postinstall script POSTs installer met...

OpenSSF/OSV malware advisory MAL-2026-11071 blocks this version. whs4_eud@1.0.1 declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On e...

OpenSSF/OSV malware advisory MAL-2026-13743 blocks this version. On npm install, the package's postinstall hook runs `node index.js`, which POSTs installer host information — the absolute...

OpenSSF/OSV malware advisory MAL-2026-11070 blocks this version. package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's a...

Direct source inspection contradicts the clean hint: the package ships an obfuscated fake-CAPTCHA redirect page as its main entrypoint. Although it has no install hook, the user-invoked b...

OpenSSF/OSV malware advisory MAL-2026-13742 blocks this version. The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), o...

Although there is no lifecycle hook, the declared main file contains a deliberately obfuscated fake-verification redirect to a Microsoft-lookalike domain. This is concrete malicious brows...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13739 blocks this version. ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector (EVC) protocol. It...

OpenSSF/OSV malware advisory MAL-2026-13741 blocks this version. safe-local-env-loader impersonates the legitimate `dotenv` package: its description, repository, homepage, and lib/main.js...