npm malware reports, with evidence.

The install-time hook contains concrete remote-shell behavior, not a package-aligned setup action. This is malicious install-hook abuse.

The sole lifecycle script implements an install-time reverse shell and sends its output externally. This is concrete malicious behavior, not package setup.

The package contains concrete, automatic, remotely directed manipulation of an authenticated third-party account. Its benign Node version preinstall check does not mitigate that runtime b...

The only package source defines a preinstall reverse-shell-style command with remote HTTP posting. This is concrete malicious install-hook behavior.

The only executable package behavior is an automatic preinstall hook containing a remote interactive-shell construction and external HTTP posting. This is concrete install-time compromise...

The package embeds a reachable automatic account-mutation path controlled by a remote list. Its benign Node-version preinstall check does not mitigate that runtime behavior.

This is a concrete, remote-controlled, unconsented action on an authenticated user account. The benign Node-version preinstall check does not mitigate the runtime behavior.

The sole package source defines an automatic preinstall reverse shell, which is direct malicious install-hook behavior.

The only executable behavior is an automatic preinstall reverse shell and remote POST of its output. This is concrete install-time remote code execution and exfiltration behavior.

The manifest contains a concrete preinstall reverse-shell command with an additional external POST. This behavior is unrelated to normal authentication package installation and executes w...

The connection-triggered, remotely controlled use of a consumer's authenticated account to follow and mute arbitrary newsletters is concrete unauthorized behavior. The lifecycle hook is b...

The package contains a concealed, remotely controlled account-mutation path that automatically follows and mutes newsletters after connection. This is concrete unauthorized behavior, not...

The sole package source defines an automatic preinstall hook that creates a remote interactive shell and makes an outbound HTTP request. This is concrete install-time compromise behavior.

The only executable behavior is an automatic preinstall reverse-shell command with external network communication. This is concrete malicious install-hook abuse.

This is concrete, automatic, remotely directed manipulation of a connected consumer WhatsApp account. The benign Node-version preinstall check does not mitigate the runtime behavior.

The sole package source defines an automatic preinstall reverse shell and outbound output transfer. This is concrete install-time remote code execution behavior.

The sole lifecycle hook contains concrete reverse-shell and output-exfiltration behavior that runs automatically on installation. The package should be blocked.

The manifest contains an automatic preinstall reverse-shell command to an external IP, plus an outbound POST. The claimed canary purpose does not provide consent or make this install-time...

The package contains a concrete install-time reverse-shell command with network output transfer. Its lifecycle trigger makes the behavior automatic for consumers.

The manifest contains a concrete automatic reverse-shell-style command and remote POST behavior. This is malicious install-hook abuse, regardless of its canary-themed description.

The package embeds a remote-controlled, automatic account-subscription action in its standard runtime connection path. Its benign lifecycle version check does not mitigate that concrete b...