npm malware reports, with evidence.

This is a concrete install-time reconnaissance and data-exfiltration path to an unrelated fixed endpoint. It is malicious install-hook abuse, not package-aligned setup.

This is a concrete automatic postinstall chain that modifies a consumer project's lifecycle configuration and broad AI-agent control surface. The absence of observed network or credential...

This package embeds an import-time backdoor that overwrites a foreign dependency and remotely directs authenticated newsletter follows. The absence of an npm lifecycle script does not rem...

The package contains a concrete import-time backdoor that mutates a third-party dependency and remotely directs authenticated account actions. The absence of an npm lifecycle hook does no...

OpenSSF Malicious Packages via OSV confirms epic-adminportal-frontend@0.0.1-security as malicious (MAL-2025-49114): Malicious code in epic-adminportal-frontend (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mw/localization@0.0.1-security as malicious (MAL-2022-251): Malicious code in @epic-mw/localization (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mw/localization@1.9.9 as malicious (MAL-2022-251): Malicious code in @epic-mw/localization (npm)

OpenSSF Malicious Packages via OSV confirms epic-adminportal-frontend@1.0.0 as malicious (MAL-2025-49114): Malicious code in epic-adminportal-frontend (npm)

OpenSSF Malicious Packages via OSV confirms egstore-graphql-client@0.0.1-security as malicious (MAL-2025-49111): Malicious code in egstore-graphql-client (npm)

OpenSSF Malicious Packages via OSV confirms egstore-graphql-client@1.0.0 as malicious (MAL-2025-49111): Malicious code in egstore-graphql-client (npm)

OpenSSF Malicious Packages via OSV confirms epic-admin-node-services@0.0.1-security as malicious (MAL-2025-49113): Malicious code in epic-admin-node-services (npm)

OpenSSF Malicious Packages via OSV confirms account-merge-site@0.0.1-security as malicious (MAL-2025-49107): Malicious code in account-merge-site (npm)

OpenSSF Malicious Packages via OSV confirms epic-admin-node-services@1.0.0 as malicious (MAL-2025-49113): Malicious code in epic-admin-node-services (npm)

OpenSSF Malicious Packages via OSV confirms account-merge-site@1.0.0 as malicious (MAL-2025-49107): Malicious code in account-merge-site (npm)

OpenSSF Malicious Packages via OSV confirms keroeltopkkk@99.99.99 as malicious (MAL-2026-16336): Malicious code in keroeltopkkk (npm)

OpenSSF Malicious Packages via OSV confirms keroeltopkk@99.99.99 as malicious (MAL-2026-16335): Malicious code in keroeltopkk (npm)

OpenSSF Malicious Packages via OSV confirms catwrestlingbird@1.0.0 as malicious (MAL-2026-16327): Malicious code in catwrestlingbird (npm)

OpenSSF Malicious Packages via OSV confirms my-cdn-script@1.0.0 as malicious (MAL-2026-16337): Malicious code in my-cdn-script (npm)

OpenSSF Malicious Packages via OSV confirms @asenfotech/unplugin-element-plus@2.9.5 as malicious (MAL-2026-16318): Malicious code in @asenfotech/unplugin-element-plus (npm)

OpenSSF Malicious Packages via OSV confirms element-plus-vite-cli@2.9.5 as malicious (MAL-2026-16331): Malicious code in element-plus-vite-cli (npm)