Malicious packages, on record.

The documented package is calendar/streak math, but its primary entry contains a concealed import-time downloader, detached executable launch, and persistence mechanism. The environment g...

This is an import-time, targeted downloader/executor with stealth persistence, unrelated to calendar or streak math. Absence of an npm lifecycle hook does not mitigate the concrete runtim...

The hidden import-time download, executable extraction, and Startup-folder persistence are concrete malware behavior unrelated to streak math. No lifecycle hook is needed because the payl...

The package establishes stealthy remote payload delivery and login persistence during ordinary import. Absence of an npm lifecycle hook does not mitigate this concrete runtime attack path.

This is a concrete remote payload and persistence mechanism unrelated to calendar/streak functionality. Absence of an npm lifecycle hook does not mitigate import-time execution.

The package's calendar utilities do not justify an import-time hidden executable drop into the Windows Startup folder. This is concrete persistence behavior despite having no npm lifecycl...

The import-time hidden download and placement of a remote executable in a Windows Startup folder is concrete persistence behavior. Absence of an npm lifecycle hook does not mitigate runti...

The package contains an import-time remote binary dropper targeting a foreign Windows Startup persistence surface. The benign calendar API does not justify this behavior.

Source inspection confirms concrete import-time remote payload delivery and Startup-folder persistence, inconsistent with the documented calendar utility. This is malicious behavior, not...

The package contains a concealed import-time remote payload delivery and persistence chain unrelated to calendar utilities. This is concrete malware behavior.

This is concrete, unconsented persistence through import-time dropping of an embedded executable, unrelated to the stated package purpose.

This is concrete hidden persistence behavior unrelated to the stated utility package and activates merely on import. Absence of an npm lifecycle hook does not mitigate the import-time dro...

This is concrete stealthy persistence via an import-time payload drop, unrelated to the documented placeholder utilities. The absence of an install hook does not mitigate the malicious ru...

The package description promises simple utilities, but its sole implementation is a concealed native payload dropper with Startup-folder persistence. The absence of lifecycle hooks does n...

Direct source inspection confirms a hidden executable payload and import-triggered Startup-folder persistence. The absent lifecycle hook does not mitigate the malicious runtime behavior.

Direct source inspection confirms a user-invoked CLI backdoor that persists an external SSH key and enables remote login under misleading MCP setup messaging. This is concrete unauthorize...