npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@1.0.77 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@1.0.73 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@1.0.39 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@1.0.35 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@1.0.33 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@0.0.31 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@0.0.28 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@0.0.25 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms @siwatfa/yorn@0.0.24 as malicious (MAL-2026-14102): Malicious code in @siwatfa/yorn (npm)

OpenSSF Malicious Packages via OSV confirms consumerweb-calurls@99.9.1 as malicious (MAL-2026-10970): Malicious code in consumerweb-calurls (npm)

OpenSSF Malicious Packages via OSV confirms commonweb-rewards@99.9.1 as malicious (MAL-2026-10968): Malicious code in commonweb-rewards (npm)

OpenSSF Malicious Packages via OSV confirms commonweb-card@99.9.1 as malicious (MAL-2026-10966): Malicious code in commonweb-card (npm)

OpenSSF Malicious Packages via OSV confirms commonweb-wallet@99.9.1 as malicious (MAL-2026-10969): Malicious code in commonweb-wallet (npm)

This is concrete install-time delivery and persistence of a native executable with explicit security-control bypass behavior. The bundled checksum provides integrity only relative to the...

The advertised server utility embeds an undisclosed global install and stealthy background process launch to a remote API. Although it is runtime-triggered rather than npm lifecycle-trigg...

The source documents and implements an install-time unsigned native payload delivery chain designed to avoid OS security warnings. Bundled checksum validation does not negate the intentio...

The package embeds a concealed, cryptographically gated decrypt-and-spawn chain in its primary Mutex implementation. This is concrete malicious runtime behavior, not an unused static prim...

Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious pr...

OpenSSF Malicious Packages via OSV confirms snavbox@1.0.2 as malicious (MAL-2025-49362): Malicious code in snavbox (npm)

The package performs concrete, unconsented postinstall mutation of the consuming project's dependency manifest through a detached delayed process. No exfiltration was found, but the insta...

Direct inspection confirms concrete install-time persistence, remote shell capability, host reconnaissance, and internal credential/service probing. This is malicious behavior unrelated t...