npm malware reports, with evidence.

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.1.21 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.1.20 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.1.19 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.1.18 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.1.17 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.1.15 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@14.0.0 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms dzyclutch-baileys@1.0.1 as malicious (MAL-2026-17620): Malicious code in dzyclutch-baileys (npm)

OpenSSF Malicious Packages via OSV confirms css-flow-render-shim@1.0.0 as malicious (MAL-2026-17655): Malicious code in css-flow-render-shim (npm)

OpenSSF Malicious Packages via OSV confirms @praveenvjpm/color-utils-7210@1.0.0 as malicious (MAL-2026-17651): Malicious code in @praveenvjpm/color-utils-7210 (npm)

The package’s automatic preinstall hook launches obfuscated code that downloads and executes a staged payload. This is concrete install-time remote code execution, supporting a malicious...

The executable browser entrypoints contain targeted page disruption and unwanted looping audio unrelated to the package's exchange functionality. The guarded trigger limits reach but does...

The package’s main entrypoint contains targeted browser disruption and looping external audio, which is concrete protestware behavior. The lack of an install hook does not remove this run...

The exported browser bundle deliberately disrupts page interaction and forces looping audio for a targeted group after a delay. This is concrete protestware behavior and warrants blocking...

Static inspection confirms active, targeted browser disruption in a bundle served by the application. This is concrete protestware behavior, so the package should be blocked.

OpenSSF Malicious Packages via OSV confirms imgbundle@1.0.2 as malicious (MAL-2026-17330): Malicious code in imgbundle (npm)

The published browser entrypoints include targeted, delayed page disruption paired with looping externally hosted audio. This is concrete protestware behavior, so the package should be bl...

The published entrypoints contain active, targeted browser disruption that is unrelated to the package’s apparent UI component purpose. This is concrete protestware behavior and warrants...

The browser bundle implements targeted, disruptive behavior unrelated to user registration. The conditional trigger does not make the page disruption or unsolicited audio benign.

The inspected browser bundle contains targeted disruptive behavior: it disables page interaction and loops externally hosted audio under language, host, and timing conditions. This suppor...

Inspected source confirms targeted browser disruption and unsolicited looping audio in dist/465.js. This is active protestware behavior, so the package should be blocked.