npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-a@1.0.0 as malicious (MAL-2026-16248): Malicious code in kartykgithub-takedown-a (npm)

This is unconsented postinstall mutation of a broad AI-agent control surface, executed through opaque bundled native code. The opt-out does not establish prior consent for the default ins...

OpenSSF Malicious Packages via OSV confirms sql-limit-enforcer@10.0.1 as malicious (MAL-2026-16151): Malicious code in sql-limit-enforcer (npm)

This package combines an automatic installation lifecycle hook with unconsented host package-manager and sudo attempts. It also harvests credentials from unrelated agent configuration for...

OpenSSF Malicious Packages via OSV confirms confx1789550882@1.0.0 as malicious (MAL-2026-16260): Malicious code in confx1789550882 (npm)

This is a concrete automatic install-hook chain that downloads and executes unverified remote native code while modifying the user environment. The lifecycle hook obscures errors, increas...

OpenSSF Malicious Packages via OSV confirms idx_form_script@999.0.2 as malicious (MAL-2026-16243): Malicious code in idx_form_script (npm)

The postinstall hook does not only write a config file; it starts a tunnel path that can plant an SSH key on a remote host and a local unauthenticated control server. That is concrete ins...

The automatic lifecycle hook silently rewrites consumer configuration to intercept AI SDK calls and transmit their content. This meets the install-hook abuse policy for a foreign AI-agent...

This is a concrete install-time mutation of a consumer AI integration that enables collection and external reporting of LLM content. The behavior is automatic rather than an explicit user...

The package contains concrete automatic install-time data transmission rather than only user-invoked networking. The lifecycle path is transparent but unconsented and suppresses its netwo...

The package executes automatic system-package installation, including sudo attempts, from its npm postinstall hook and repeats it at CLI startup. This is a concrete install-hook abuse rat...

The published entrypoints contain concrete, import-time protestware that disables page interaction and fetches looping audio for targeted visitors. That is unconsented attack behavior in...

The postinstall hook downloads and installs an unverified native binary from a raw IP with TLS verification disabled, then the CLI launcher executes it. That is a concrete unconsented ins...

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-a@1.0.1 as malicious (MAL-2026-16248): Malicious code in kartykgithub-takedown-a (npm)

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-b@1.0.0 as malicious (MAL-2026-16249): Malicious code in kartykgithub-takedown-b (npm)

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-a@1.0.2 as malicious (MAL-2026-16248): Malicious code in kartykgithub-takedown-a (npm)

The automatic postinstall hook persistently changes the user's command environment and starts a restartable user service without an explicit setup command. This is unconsented install-tim...

OpenSSF Malicious Packages via OSV confirms kartyk-github-oidc-test-pkg@1.0.4 as malicious (MAL-2026-16244): Malicious code in kartyk-github-oidc-test-pkg (npm)

OpenSSF Malicious Packages via OSV confirms kartyk-github-token-pkg@1.0.4 as malicious (MAL-2026-16246): Malicious code in kartyk-github-token-pkg (npm)