npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms catwrestlingbird@1.0.0 as malicious (MAL-2026-16327): Malicious code in catwrestlingbird (npm)

OpenSSF Malicious Packages via OSV confirms my-cdn-script@1.0.0 as malicious (MAL-2026-16337): Malicious code in my-cdn-script (npm)

OpenSSF Malicious Packages via OSV confirms @asenfotech/unplugin-element-plus@2.9.5 as malicious (MAL-2026-16318): Malicious code in @asenfotech/unplugin-element-plus (npm)

OpenSSF Malicious Packages via OSV confirms element-plus-vite-cli@2.9.5 as malicious (MAL-2026-16331): Malicious code in element-plus-vite-cli (npm)

OpenSSF Malicious Packages via OSV confirms test1sdsd2@99.99.99 as malicious (MAL-2026-16316): Malicious code in test1sdsd2 (npm)

OpenSSF Malicious Packages via OSV confirms test12vv36@99.99.99 as malicious (MAL-2026-16311): Malicious code in test12vv36 (npm)

OpenSSF Malicious Packages via OSV confirms npx-test-ma980@1.0.1 as malicious (MAL-2026-16310): Malicious code in npx-test-ma980 (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge2/xa@1.1.0 as malicious (MAL-2026-16306): Malicious code in @nimbusedge2/xa (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge2/x@1.1.1 as malicious (MAL-2026-16305): Malicious code in @nimbusedge2/x (npm)

The automatic lifecycle hook contains a remote interactive-shell pattern and external data-posting command. This is malicious install-hook abuse.

OpenSSF Malicious Packages via OSV confirms @insiderintelligence/googleadmanager@9.9.10 as malicious (MAL-2026-16290): Malicious code in @insiderintelligence/googleadmanager (npm)

Source shows a fake Cloudflare interstitial whose obfuscated script fetches, AES-decrypts, and follows a remote redirect_url. That is concrete malware behavior even though npm install its...

Source is a complete fake Cloudflare challenge that hides a remote fetch, AES-CTR decrypt, and URL redirect behind obfuscation. That is a working browser malware loader even though npm in...

Source shows a fake Cloudflare challenge page whose only job is to gate a fetch, AES-decrypt a destination, and redirect the browser. That is concrete malware behavior even though npm ins...

OpenSSF Malicious Packages via OSV confirms x509-escaping@1.0.1 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms tailwindcss-forms-ui@0.5.2 as malicious (MAL-2026-16295): Malicious code in tailwindcss-forms-ui (npm)

OpenSSF Malicious Packages via OSV confirms x509-escaping@0.0.2 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms x509-escaping@0.0.1 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms x509-escaping@0.0.0 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms @shared-runtime/modules@9.9.10 as malicious (MAL-2026-16291): Malicious code in @shared-runtime/modules (npm)