npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms anuaja@1.0.0 as malicious (MAL-2026-17386): Malicious code in anuaja (npm)

OpenSSF Malicious Packages via OSV confirms @sairidev/baileys-new@0.3.21 as malicious (MAL-2026-17378): Malicious code in @sairidev/baileys-new (npm)

OpenSSF Malicious Packages via OSV confirms @ostyado/baileys@2.0.6 as malicious (MAL-2026-17372): Malicious code in @ostyado/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @baanx/common@9.9.9 as malicious (MAL-2026-16485): Malicious code in @baanx/common (npm)

OpenSSF Malicious Packages via OSV confirms sk-lib-enc@1.0.2 as malicious (MAL-2026-17284): Malicious code in sk-lib-enc (npm)

OpenSSF Malicious Packages via OSV confirms tailwindcss-form-kit@0.5.6 as malicious (MAL-2026-17221): Malicious code in tailwindcss-form-kit (npm)

OpenSSF Malicious Packages via OSV confirms @baanx/solana-lib@9.9.9 as malicious (MAL-2026-16300): Malicious code in @baanx/solana-lib (npm)

OpenSSF Malicious Packages via OSV confirms @baanx/domain@9.9.9 as malicious (MAL-2026-16486): Malicious code in @baanx/domain (npm)

OpenSSF Malicious Packages via OSV confirms @baanx/blockchain-config@9.9.9 as malicious (MAL-2026-16352): Malicious code in @baanx/blockchain-config (npm)

OpenSSF Malicious Packages via OSV confirms @baanx/abis@9.9.9 as malicious (MAL-2026-16351): Malicious code in @baanx/abis (npm)

OpenSSF Malicious Packages via OSV confirms tailwindcss-form-kit@0.5.1 as malicious (MAL-2026-17221): Malicious code in tailwindcss-form-kit (npm)

OpenSSF Malicious Packages via OSV confirms z-deno-truth-ya1t4m@1.0.0 as malicious (MAL-2026-16472): Malicious code in z-deno-truth-ya1t4m (npm)

OpenSSF Malicious Packages via OSV confirms ts-rand-sdk@1.0.4 as malicious (MAL-2026-14193): Malicious code in ts-rand-sdk (npm)

The package executes an obfuscated bundled Windows payload automatically from both primary entrypoints. This is concrete malware behavior, not a user-requested configuration operation.

The active constructor-to-detached-payload chain establishes concealed code execution. Opaque encrypted payload storage and in-place decryption make this malware behavior rather than ordi...

The automatic lifecycle hook performs concrete cross-platform Claude Desktop configuration mutation. This meets the install-hook abuse blocking policy.

The only entry point implements an obfuscated, remotely controlled redirect chain whose target is encrypted until runtime. That concealed active behavior is malicious.

The automatic lifecycle chain mutates a broad AI-agent control surface and downloads current external installer code through npx. This meets the install-hook abuse blocking boundary.

The automatic post-install chain mutates foreign AI-agent configuration and installs executable lifecycle hooks without interactive consent. This is concrete install-hook abuse under the...

This is concrete, selective website disruption executed on import, not a component-library feature. The remote audio and input blocking establish active protestware behavior.

OpenSSF Malicious Packages via OSV confirms llm-nebula@1.0.0 as malicious (MAL-2026-17230): Malicious code in llm-nebula (npm)