npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms kartyk-github-oidc-test-pkg@1.0.2 as malicious (MAL-2026-16244): Malicious code in kartyk-github-oidc-test-pkg (npm)

This is malicious agent-control behavior combined with unconsented automatic mutation of the host configuration and dependency environment. The lack of an npm install lifecycle hook does...

OpenSSF Malicious Packages via OSV confirms html-to-gutenberg@4.2.21 as malicious (MAL-2026-6359): Malicious code in html-to-gutenberg (npm)

The automatic lifecycle hook, self-dependency constrained to an older release, project environment access, and database authorization seeding form a concrete install-hook abuse chain. The...

The source establishes an automatic, unpinned self-install chain into a remote sandbox and a lifecycle hook that persistently changes command execution and shell configuration. This match...

The automatic postinstall chain performs broad SSH and system mutations, including remote authorized-key installation and persistent background services. This is concrete install-hook abu...

This is an unconsented install-time system modification with privileged command attempts, not ordinary dependency setup. The repeated startup path increases the persistence of that behavior.

This is concrete, unconsented install-time host data exfiltration with no corresponding package functionality. It is malicious install-hook abuse.

OpenSSF Malicious Packages via OSV confirms strapi-plugin-osag@3.6.8 as malicious (MAL-2026-16235): Malicious code in strapi-plugin-osag (npm)

OpenSSF Malicious Packages via OSV confirms strapi-plugin-os-rec@3.6.8 as malicious (MAL-2026-16234): Malicious code in strapi-plugin-os-rec (npm)

The package performs an automatic postinstall download or execution of opaque native code and immediately uses it to install Codex and Claude Code hooks. This is concrete install-hook abu...

The automatic lifecycle mutation of a foreign AI CLI, unverified remote executable installation, and forced self-update form a concrete install-hook abuse chain. No exfiltration is requir...

The automatic global installation of a separate AI-agent CLI is a concrete foreign control-surface mutation. Persistent PATH and desktop changes increase the impact of that lifecycle hook.

OpenSSF Malicious Packages via OSV confirms jexkcode@1.1.4 as malicious (MAL-2026-16220): Malicious code in jexkcode (npm)

OpenSSF Malicious Packages via OSV confirms jexkcode@1.1.3 as malicious (MAL-2026-16220): Malicious code in jexkcode (npm)

OpenSSF Malicious Packages via OSV confirms jexkcode@1.1.2 as malicious (MAL-2026-16220): Malicious code in jexkcode (npm)

OpenSSF Malicious Packages via OSV confirms jexkcode@1.1.1 as malicious (MAL-2026-16220): Malicious code in jexkcode (npm)

OpenSSF Malicious Packages via OSV confirms jexkcode@1.1.0 as malicious (MAL-2026-16220): Malicious code in jexkcode (npm)

OpenSSF Malicious Packages via OSV confirms jexkcode@1.0.1 as malicious (MAL-2026-16220): Malicious code in jexkcode (npm)

This package creates an unconsented install-time remote binary delivery and persistence path with no independent integrity verification. The absence of secret harvesting does not mitigate...

The automatic postinstall modifies both package-manager behavior and foreign AI-agent instruction surfaces. The included reviewer-directed secret-suppression rule reinforces malicious int...