npm malware reports, with evidence.

The lifecycle hook creates a complete automatic chain from npm installation to writes in multiple AI-agent skill directories. This meets the policy for a blocking install-hook control-sur...

OpenSSF Malicious Packages via OSV confirms turbo-ws@1.0.0 as malicious (MAL-2026-16440): Malicious code in turbo-ws (npm)

Active, concealed execution of an image-carried PowerShell command occurs on normal package use. The hidden detached launcher is concrete malware behavior.

The launcher deliberately disables or weakens host security controls before downloading and executing a remote binary. This is concrete malicious behavior despite requiring an explicit CL...

The automatic lifecycle hook combines deliberate obfuscation, staged payload handling, filesystem writes, and process execution. This meets the install-hook abuse boundary for blocking pu...

Hidden extraction and detached execution of an opaque PowerShell payload is concrete malware behavior, not environment configuration functionality. Automatic activation from both runtime...

The automatic, heavily obfuscated preinstall loader has concealed payload-handling and child-process capability, which is concrete install-hook abuse. The normal SDK entrypoint does not j...

The package contains an automatic, deliberately obfuscated install hook that reconstructs and launches a hidden payload. This is concrete install-hook abuse and is not justified by the ex...

The automatic lifecycle hook persistently modifies global Claude command hooks without an explicit user setup action. This meets the policy threshold for install-hook abuse.

OpenSSF Malicious Packages via OSV confirms @bb1ptest23/test-paket@1.0.3 as malicious (MAL-2026-17201): Malicious code in @bb1ptest23/test-paket (npm)

The automatic lifecycle chain modifies a foreign AI-agent environment and installs MCP capabilities without an explicit setup command or target choice. This meets the install-control-surf...

The lifecycle hook performs covert executable deployment and detached execution during installation. This is concrete malicious install-hook abuse.

Both published builds embed sweetalert2 protestware that, on import in matching browsers, disables page interaction and fetches a remote audio file. That is concrete hostile behavior in t...

The postinstall hook downloads and executes a third-party installer by default, then configures that tool in the user home directory. An opt-out flag does not make that unsolicited remote...

The package entry is a disguised browser redirector that hides its destination behind obfuscation and AES decryption, then forwards the visitor and query string. That is concrete cloaked...

Import-time obfuscated HTTPS fetch, AES decryption of the response, and forged npm postinstall errors are a hidden remote kill switch, not ordinary SAP connectivity. The decrypted body is...

The automatic postinstall hook invokes all-agent hook installation when it finds existing foreign agent directories. Under the install-control-surface policy, this is concrete install-hoo...

The package performs broad, unconsented consumer-project mutation during postinstall and installs a plugin that maintains its integration. This is concrete install-hook abuse even though...

The package contains concrete, automatic install-hook data collection and transmission. Its loopback destination does not remove the unconsented collection behavior or the risk from a loc...

The automatic lifecycle hook gathers and transmits host identity data, while the package metadata explicitly frames the behavior as dependency confusion. This is concrete malicious instal...