npm malware reports, with evidence.

This is concrete security-control tampering paired with unverified remote binary execution, not a necessary transparent CLI bootstrap. The absence of an install hook limits the trigger to...

The explicit Windows registry modification disables a protective control, and the CLI then executes unverified remote binaries with inherited environment variables. The lack of an install...

This package contains concrete host-security weakening and concealed elevation in its user-invoked command path. The absence of an install hook does not neutralize this malicious runtime...

OpenSSF Malicious Packages via OSV confirms ac-polyfills@99.9.9 as malicious (MAL-2026-782): Malicious code in ac-polyfills (npm)

OpenSSF Malicious Packages via OSV confirms xzvbailsx@1.0.0 as malicious (MAL-2026-16279): Malicious code in xzvbailsx (npm)

OpenSSF Malicious Packages via OSV confirms xzvbailey@1.0.0 as malicious (MAL-2026-16278): Malicious code in xzvbailey (npm)

OpenSSF Malicious Packages via OSV confirms zero-baileys@2.7.0 as malicious (MAL-2026-16280): Malicious code in zero-baileys (npm)

OpenSSF Malicious Packages via OSV confirms xa424234657567@1.0.0 as malicious (MAL-2026-16277): Malicious code in xa424234657567 (npm)

OpenSSF Malicious Packages via OSV confirms chai-as-buffered@7.2.5 as malicious (MAL-2026-10041): Malicious code in chai-as-buffered (npm)

OpenSSF Malicious Packages via OSV confirms chai-as-buffered@3.7.24 as malicious (MAL-2026-10041): Malicious code in chai-as-buffered (npm)

The automatic postinstall mutation of shared global commands used by AI agents is a concrete, unconsented broad control-surface change. The additional unpinned install-time dependency fet...

OpenSSF Malicious Packages via OSV confirms @lekzo/baileys@0.0.1 as malicious (MAL-2026-16276): Malicious code in @lekzo/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mod-market/ui@0.0.1-security as malicious (MAL-2022-250): Malicious code in @epic-mod-market/ui (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mod-market/ui@99.9.8 as malicious (MAL-2022-250): Malicious code in @epic-mod-market/ui (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mod-market/ui@1.9.9 as malicious (MAL-2022-250): Malicious code in @epic-mod-market/ui (npm)

OpenSSF Malicious Packages via OSV confirms randompkga@1.0.7 as malicious (MAL-2026-16255): Malicious code in randompkga (npm)

OpenSSF Malicious Packages via OSV confirms randompkga@1.0.5 as malicious (MAL-2026-16255): Malicious code in randompkga (npm)

OpenSSF Malicious Packages via OSV confirms randompkga@1.0.4 as malicious (MAL-2026-16255): Malicious code in randompkga (npm)

OpenSSF Malicious Packages via OSV confirms blue-string-formatter-utils@1.0.0 as malicious (MAL-2026-16273): Malicious code in blue-string-formatter-utils (npm)

OpenSSF Malicious Packages via OSV confirms kartykgithub-multiversion-a@1.0.1 as malicious (MAL-2026-16272): Malicious code in kartykgithub-multiversion-a (npm)