npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14443 blocks this version. The OpenSSF Package Analysis project identified '@elc-online/up-analytics' @ 99.99.99 (npm) as malicious.

This package ships an obfuscated remote redirect loader behind a counterfeit security-verification flow. The absence of install hooks limits install-time impact but does not negate the ac...

The distributed main entrypoint contains an obfuscated, import-triggered remote payload loader unrelated to the package’s stated functionality. Absence of lifecycle hooks does not mitigat...

Direct source inspection found a concrete unsolicited postinstall network callback that fingerprints the installing host. This is malicious install-time data exfiltration, not a package-a...

The sole package file defines an automatic install-time callback that collects and transmits local environment and directory information to an unrelated webhook endpoint. This is concrete...

Direct manifest inspection confirms an unconsented install-time external callback carrying host identity. The stated research purpose does not remove the package's concrete attack behavior.

This is concrete, unconsented install-time host-identifying data exfiltration to an external callback endpoint. The minimal package contents do not reduce the confirmed lifecycle attack.

The only package file defines an automatic install-time external callback that fingerprints the installing host. This is concrete unconsented data exfiltration.

Source confirms unconsented postinstall mutation of foreign AI-agent control surfaces. The absence of credential exfiltration does not remove this concrete install-time control-surface at...

The package is an active remote-payload installer with concealed persistence and foreign AI-tool configuration mutation. Although it lacks npm lifecycle hooks, these concrete behaviors wa...

OpenSSF/OSV malware advisory MAL-2026-14416 blocks this version. On any `import 'dims-hydration-ui'`, index.mjs chmods 0755 and spawns a bundled Linux x86_64 ELF at dist/internal/calc.dat...

OpenSSF/OSV malware advisory MAL-2026-14418 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...

OpenSSF/OSV malware advisory MAL-2026-4818 blocks this version. saturn-bail is a Baileys-derivative WhatsApp library that, on every `makeWASocket()` call, schedules a 90-second timer whic...

OpenSSF/OSV malware advisory MAL-2026-14404 blocks this version. Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do w...

OpenSSF/OSV malware advisory MAL-2026-14404 blocks this version. Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do w...

OpenSSF/OSV malware advisory MAL-2026-13456 blocks this version. santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) re...

OpenSSF/OSV malware advisory MAL-2026-14440 blocks this version. web-advertising@999.9.16 declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install....

OpenSSF/OSV malware advisory MAL-2026-14440 blocks this version. web-advertising@999.9.16 declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install....

OpenSSF/OSV malware advisory MAL-2026-14438 blocks this version. package.json declares `preinstall: node index.js`, so `npm install` automatically runs index.js. index.js reads os.hostnam...

OpenSSF/OSV malware advisory MAL-2026-14434 blocks this version. The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS server...