npm advisory reports, with evidence.

OpenSSF Malicious Packages via OSV confirms @teamolduser/baileys@9.7.2 as malicious (MAL-2026-17380): Malicious code in @teamolduser/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @queenanya/baileys@9.7.2 as malicious (MAL-2026-17373): Malicious code in @queenanya/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @saazkira/baileys@2.1.7 as malicious (MAL-2026-17377): Malicious code in @saazkira/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @saazkira/baileys@2.1.6 as malicious (MAL-2026-17377): Malicious code in @saazkira/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @teamolduser/baileys@9.7.3-beta.1 as malicious (MAL-2026-17380): Malicious code in @teamolduser/baileys (npm)

OpenSSF Malicious Packages via OSV confirms @lendkzn/xntaabail@7.0.0 as malicious (MAL-2026-17364): Malicious code in @lendkzn/xntaabail (npm)

OpenSSF Malicious Packages via OSV confirms @nyzzpedia/baileys-new@1.0.0 as malicious (MAL-2026-17370): Malicious code in @nyzzpedia/baileys-new (npm)

OpenSSF Malicious Packages via OSV confirms @zeronexcode/baileys@7.0.0-zeronex.8 as malicious (MAL-2026-17326): Malicious code in @zeronexcode/baileys (npm)

The active preinstall hook performs unconsented environment-data exfiltration unrelated to the package's runtime functionality. The collection and actual network send are directly establi...

The source establishes automatic, unconsented export of identifying installation data unrelated to the package's color-generation functionality. This supports blocking for data exfiltrati...

The source establishes automatic, unconsented transmission of identifying local information to an unrelated external recipient. This concrete installation-time data exfiltration warrants...

The inspected source establishes automatic, unconsented export of local identifying information unrelated to the package's functionality. The active collection and network send support a...

The source establishes automatic, unconsented transmission of local identifying information to an unrelated endpoint during installation. This is concrete data exfiltration rather than an...

The automatic lifecycle performs concrete, unconsented data exfiltration unrelated to the package's date-formatting functionality. The collection and actual network send are directly esta...

Source proves automatic, unconsented export of identifying local information during installation. The external reporting behavior is unrelated to the package’s arithmetic functionality an...

The source proves automatic, unconsented export of local identifying information to an unrelated external recipient. This concrete install-time data exfiltration warrants blocking.

The source establishes automatic collection and external transmission of identifying local information during installation. This concrete data exfiltration supports blocking the package.

OpenSSF Malicious Packages via OSV confirms runhelper@1.0.0 as malicious (MAL-2026-17332): Malicious code in runhelper (npm)

OpenSSF Malicious Packages via OSV confirms imgbundle@1.0.1 as malicious (MAL-2026-17330): Malicious code in imgbundle (npm)

OpenSSF Malicious Packages via OSV confirms imgbundle@1.0.0 as malicious (MAL-2026-17330): Malicious code in imgbundle (npm)