npm advisory reports, with evidence.

OpenSSF Malicious Packages via OSV confirms troubleshooting@0.1.0 as malicious (MAL-2026-17641): Malicious code in troubleshooting (npm)

OpenSSF Malicious Packages via OSV confirms browser-metrics-plugin.contrib@2.0.1 as malicious (MAL-2026-17640): Malicious code in browser-metrics-plugin.contrib (npm)

OpenSSF Malicious Packages via OSV confirms browser-metrics-plugin.contrib@1.0.1 as malicious (MAL-2026-17640): Malicious code in browser-metrics-plugin.contrib (npm)

OpenSSF Malicious Packages via OSV confirms browser-metrics-plugin.contrib@1.1.0 as malicious (MAL-2026-17640): Malicious code in browser-metrics-plugin.contrib (npm)

OpenSSF Malicious Packages via OSV confirms browser-metrics-plugin.contrib@1.0.0 as malicious (MAL-2026-17640): Malicious code in browser-metrics-plugin.contrib (npm)

OpenSSF Malicious Packages via OSV confirms browser-metrics-plugin.contrib@0.0.1 as malicious (MAL-2026-17640): Malicious code in browser-metrics-plugin.contrib (npm)

OpenSSF Malicious Packages via OSV confirms windows_registry_editor@0.0.1-security as malicious (MAL-2025-49244): Malicious code in windows_registry_editor (npm)

OpenSSF Malicious Packages via OSV confirms e2e-test-utils@0.0.1-security as malicious (MAL-2025-47990): Malicious code in e2e-test-utils (npm)

OpenSSF Malicious Packages via OSV confirms e2e-test-utils@2.0.0 as malicious (MAL-2025-47990): Malicious code in e2e-test-utils (npm)

OpenSSF Malicious Packages via OSV confirms eslint-config-support@0.0.1-security as malicious (MAL-2022-2806): Malicious code in eslint-config-support (npm)

OpenSSF Malicious Packages via OSV confirms eslint-config-support@1.1.0 as malicious (MAL-2022-2806): Malicious code in eslint-config-support (npm)

OpenSSF Malicious Packages via OSV confirms eslint-config-support@1.0.5 as malicious (MAL-2022-2806): Malicious code in eslint-config-support (npm)

OpenSSF Malicious Packages via OSV confirms eslint-config-support@1.0.4 as malicious (MAL-2022-2806): Malicious code in eslint-config-support (npm)

OpenSSF Malicious Packages via OSV confirms windows_registry_editor@1.0.0 as malicious (MAL-2025-49244): Malicious code in windows_registry_editor (npm)

The postinstall hook activates an outbound beacon that transmits machine identity and project path metadata to an unrelated hard-coded endpoint. This is active, unsolicited data exfiltrat...

The package automatically transmits host and project location metadata to an unrelated external endpoint during installation and import. This is concrete data exfiltration, so the package...

The registry script contains active command execution and external transmission of collected system information, behavior unrelated to the stated CSS polyfill purpose. This is concrete ma...

Inspected source proves automatic, concealed execution of a bundled encoded PowerShell command through a self-deleting script. This concrete behavior supports blocking independently of sc...

Inspected source contains concrete exfiltration and remote code execution unrelated to CSS polyfill functionality. The registry manifest provides a loading path to this active payload.

OpenSSF Malicious Packages via OSV confirms hardhat-init@2.21.0 as malicious (MAL-2026-17636): Malicious code in hardhat-init (npm)