npm malware reports, with evidence.

The package contains an automatic preinstall hook that harvests machine identity fields and sends them over HTTP. This is concrete install-hook abuse and is not necessary for the declared...

Automatic collection and transmission of host identity data during preinstall is concrete install-hook abuse. The package's dependency-confusion framing reinforces malicious intent.

This package contains an active preinstall payload intended to run when a dependency-confusion target installs it. The automatic collection and network action make this a blockable instal...

The package contains an automatic preinstall hook that collects and sends local identifiers. This is concrete install-hook abuse, not required behavior for the declared module.

The package uses an automatic install hook to execute a remotely fetched shell installer and configure a separate AI-related tool in the user's environment. This is an unconsented lifecyc...

The automatic, forced user-scope agent-skill installation is concrete install-hook abuse. Its global scope and behavior-changing instructions meet the blocking policy even without evidenc...

Import of the published entrypoint is a dropper: it decrypts a concealed payload with a hardcoded key and writes an executable while deleting the staging file. The image-conversion API do...

Import-time code hides an AES dropper behind an image-conversion API and plants a mode-0700 executable from a concealed temp payload. That is concrete malware behavior even though this fi...

OpenSSF Malicious Packages via OSV confirms @alphaspace/core@99.0.3 as malicious (MAL-2026-17169): Malicious code in @alphaspace/core (npm)

OpenSSF Malicious Packages via OSV confirms cma-self-hosted-sandbox-cf@1.0.0 as malicious (MAL-2026-17190): Malicious code in cma-self-hosted-sandbox-cf (npm)

The automatic postinstall performs broad, unconsented mutation of an external AI-agent configuration and establishes a lifecycle self-dependency chain. This is concrete install-hook abuse...

The preinstall hook performs broad host reconnaissance and deliberately publishes the report world-readable under /tmp for a less-privileged reader. That is concrete install-hook abuse ev...

The preinstall hook unconditionally performs broad host and container-escape reconnaissance and stores it on disk, which is concrete install-hook abuse. Claims that the package is a read-...

The published entrypoint is an obfuscated loader that detects debugging and then decrypts and compiles a hidden embedded script. That is concrete concealed execution, so the package shoul...

This is concrete unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle behavior meets the install-hook abuse blocking policy even though no network exfiltrat...

The launcher, overlay, screen grabber, and browser-cookie decryptor are concrete stealth and credential-theft behavior under a false package description. Install does not auto-start them,...

The published socket path silently subscribes the connected WhatsApp account to a publisher-selected newsletter, which is concrete unconsented account abuse. The obfuscated timer, swallow...

This is concealed, remotely controlled activity performed through the consumer's authenticated messaging socket and is unrelated to a requested socket operation. The absence of an install...

The package contains a covert remote-controlled action path activated during ordinary socket creation. Its external list controls authenticated requests without user direction.

The connect path hides a remote fetch and uses the user's WhatsApp session to follow newsletters from that list. Obfuscation and swallowed errors show this is intentional account abuse, n...

The published entrypoint conceals a third-party fault-config endpoint and lets that response drive fabricated network errors, including replacement of the payment-path whitelist. That is...