npm malware reports, with evidence.

The package uses an import-time side effect to execute a bundled Windows remote-control agent. Its capture, command, persistence, and network capabilities establish concrete malicious beh...

The runtime import chain silently executes a bundled Windows binary whose static contents indicate remote command capability and persistence. The absence of an npm install hook does not m...

OpenSSF/OSV malware advisory MAL-2026-11160 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11161 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-11158 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpo...

OpenSSF/OSV malware advisory MAL-2026-11159 blocks this version. package.json defines both preinstall and postinstall lifecycle scripts that run curl against a hardcoded webhook.site endp...

OpenSSF/OSV malware advisory MAL-2026-11157 blocks this version. The OpenSSF Package Analysis project identified '@mypwn/hawkeye' @ 99.0.0 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-10981 blocks this version. index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODE_ENV!= 'p...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-11133 blocks this version. The published tarball's dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) execute a...

OpenSSF/OSV malware advisory MAL-2026-11134 blocks this version. The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity (...

OpenSSF/OSV malware advisory MAL-2026-11147 blocks this version. On npm install, postinstall.js executes shell commands that query cloud instance metadata services (AWS IMDS at 169.254.16...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...

OpenSSF/OSV malware advisory MAL-2026-11155 blocks this version. Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the packag...

OpenSSF/OSV malware advisory MAL-2026-11132 blocks this version. plugin.js (the package main) contains an appended top-level IIFE that runs on any require/import of the package. Every net...

OpenSSF/OSV malware advisory MAL-2026-11144 blocks this version. The package's postinstall hook runs `node index.js`, which spawns a detached worker that downloads two Windows executables...

OpenSSF/OSV malware advisory MAL-2026-11142 blocks this version. index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and li...

OpenSSF/OSV malware advisory MAL-2026-11150 blocks this version. On import of index.mjs, setImmediate invokes a _syncWorkspace routine whose network destination and paths are reconstructe...

OpenSSF/OSV malware advisory MAL-2026-11054 blocks this version. The package's postinstall script (test.js) executes multiple installer-side attacks on npm install. It recursively walks t...

OpenSSF/OSV malware advisory MAL-2026-11145 blocks this version. The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node (repository f...