npm malware reports, with evidence.

Static source inspection shows the package is purpose-built for mass phishing/spam and sender impersonation, with obfuscated implementation and webmail auto-send behavior. The install hoo...

OpenSSF/OSV malware advisory MAL-2026-6585 blocks this version. On `npm install`, the package's postinstall hook (`scripts/install-check.cjs`, wired via package.json `scripts.postinstall`...

OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...

Source inspection confirms user-level persistence, remote command execution, and arbitrary path upload behavior that is not limited to benign package functionality. The absence of npm lif...

OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...

OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6722 blocks this version. date-fns-lite@1.0.10 presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs autom...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6722 blocks this version. date-fns-lite@1.0.10 presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs autom...

OpenSSF/OSV malware advisory MAL-2026-6723 blocks this version. On `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `docum...

OpenSSF/OSV malware advisory MAL-2026-6722 blocks this version. date-fns-lite@1.0.10 presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs autom...