npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms santana-baileys@2.0.1 as malicious (MAL-2026-13456): Malicious code in santana-baileys (npm)

Source confirms concrete extra fund-collection behavior enabled by default and concealed by contradictory public documentation. It is not an install hook, but it directly causes unconsent...

OpenSSF Malicious Packages via OSV confirms react-remove-properties@6.14.1 as malicious (MAL-2026-14484): Malicious code in react-remove-properties (npm)

OpenSSF Malicious Packages via OSV confirms modules-newline@0.0.6 as malicious (MAL-2026-14483): Malicious code in modules-newline (npm)

OpenSSF Malicious Packages via OSV confirms css-import-order@1.1.0 as malicious (MAL-2026-14473): Malicious code in css-import-order (npm)

This is concrete import-time execution of a bundled malicious native payload, not a package-aligned accelerator. No lifecycle hook is needed for the payload to activate when the advertise...

This is concrete package-controlled financial diversion from a user-configured wallet, enabled by default and contradicted by the README. There is no install-time execution, but runtime b...

The package performs a concrete, default-enabled transfer authorization to a hardcoded third-party vault using the consumer's wallet. Disclosure in source and an opt-out do not cure the c...

The source implements an install-time remote native payload chain explicitly designed to evade OS download protections, followed by persistence-like desktop registration. This is concrete...

The package performs an undisclosed, automatic action on the user's authenticated WhatsApp account, concealed in an obfuscated policy module. Its install hook is not the attack vector, bu...

The import-time executable is concrete, unrelated to the package purpose, and contains explicit malware capabilities. No install hook is needed for impact because ordinary application imp...

Source confirms a deliberate GitLens license-bypass and foreign extension overwrite capability. This is concrete malicious behavior despite not being activated by postinstall.

The package contains concrete, automatic, unconsented mutation of outgoing user media metadata. Although the lifecycle hook is benign and no host credential theft was found, the hidden at...

The package executes an opaque, network-capable native binary during ordinary import and detaches it from the host process. The visible JavaScript functionality does not require that binary.

This package ships an obfuscated remote redirect loader behind a counterfeit security-verification flow. The absence of install hooks limits install-time impact but does not negate the ac...

The unused import-time obfuscated payload is concrete malicious concealment and reaches runtime through the package main entrypoint. Absence of lifecycle hooks does not mitigate import-ti...

The package contains a concrete concealed remote redirect chain behind a security-verification facade. It is not install-time malware, but its runtime behavior is malicious.

OpenSSF Malicious Packages via OSV confirms snavbox@1.0.3 as malicious (MAL-2025-49362): Malicious code in snavbox (npm)

This package disguises a full remote-access and theft payload as a date-math accelerator, then launches it during ordinary import. The lack of an npm lifecycle script does not mitigate th...

Source inspection confirms a concealed remote-controlled redirect chain rather than a legitimate npm package function. The hidden destination and encrypted response prevent review of the...