npm malware reports, with evidence.

Import of the published entrypoint is a dropper: it decrypts a concealed payload with a hardcoded key and writes an executable while deleting the staging file. The image-conversion API do...

Import-time code hides an AES dropper behind an image-conversion API and plants a mode-0700 executable from a concealed temp payload. That is concrete malware behavior even though this fi...

The automatic postinstall performs broad, unconsented mutation of an external AI-agent configuration and establishes a lifecycle self-dependency chain. This is concrete install-hook abuse...

The preinstall hook performs broad host reconnaissance and deliberately publishes the report world-readable under /tmp for a less-privileged reader. That is concrete install-hook abuse ev...

The preinstall hook unconditionally performs broad host and container-escape reconnaissance and stores it on disk, which is concrete install-hook abuse. Claims that the package is a read-...

The published entrypoint is an obfuscated loader that detects debugging and then decrypts and compiles a hidden embedded script. That is concrete concealed execution, so the package shoul...

This is concrete unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle behavior meets the install-hook abuse blocking policy even though no network exfiltrat...

The launcher, overlay, screen grabber, and browser-cookie decryptor are concrete stealth and credential-theft behavior under a false package description. Install does not auto-start them,...

The published socket path silently subscribes the connected WhatsApp account to a publisher-selected newsletter, which is concrete unconsented account abuse. The obfuscated timer, swallow...

This is concealed, remotely controlled activity performed through the consumer's authenticated messaging socket and is unrelated to a requested socket operation. The absence of an install...

The package contains a covert remote-controlled action path activated during ordinary socket creation. Its external list controls authenticated requests without user direction.

The connect path hides a remote fetch and uses the user's WhatsApp session to follow newsletters from that list. Obfuscation and swallowed errors show this is intentional account abuse, n...

The published entrypoint conceals a third-party fault-config endpoint and lets that response drive fabricated network errors, including replacement of the payment-path whitelist. That is...

The runtime bundle hides a year check that throws an empty error after 2026 and aborts module initialization, which is a concrete protestware time bomb. No install hook or data theft was...

The lifecycle hook performs broad AI-agent configuration mutation and automatic plugin installation. This is a concrete install-hook abuse chain, not an explicit user-invoked setup flow.

The main callable path reaches deliberately concealed dynamically constructed code. This is concrete active malicious behavior, even though the concealed payload's final actions are not s...

Handshake and socket setup silently follow channels from operator-controlled GitHub JSON and stamp media with a fixed newsletter, using the victim's WhatsApp session. The obfuscation and...

The package silently uses the authenticated WhatsApp session to follow newsletters supplied by an obfuscated third-party URL, which is concrete malicious session abuse. There is no instal...

The package contains a concealed, automatically activated remote-control path that drives authenticated WhatsApp activity. This is concrete malicious runtime behavior, despite the absence...

This is active, unconsented account manipulation combined with obfuscated policy code and remote device telemetry. The behavior is concrete and executes during normal authenticated use.

The automatic postinstall chain modifies global Claude configuration, installs event hooks, and adds an MCP server without an explicit user setup action. This meets the install-hook abuse...