npm advisory reports, with evidence.

The package's only runtime behavior is an automatic request that sends the machine hostname and OS platform to an unrelated oast.fun callback. That is concrete import-time data exfiltrati...

OpenSSF Malicious Packages via OSV confirms epic-react-webpack-starter@0.0.1-security as malicious (MAL-2025-49188): Malicious code in epic-react-webpack-starter (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-testing@0.0.1-security as malicious (MAL-2025-49187): Malicious code in epic-react-testing (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-test-utils@0.0.1-security as malicious (MAL-2025-49186): Malicious code in epic-react-test-utils (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-survey@0.0.1-security as malicious (MAL-2025-49185): Malicious code in epic-react-survey (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-slick@0.0.1-security as malicious (MAL-2025-49184): Malicious code in epic-react-slick (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-search@0.0.1-security as malicious (MAL-2025-49183): Malicious code in epic-react-search (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-form@0.0.1-security as malicious (MAL-2025-49182): Malicious code in epic-react-form (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-common@0.0.1-security as malicious (MAL-2025-49181): Malicious code in epic-react-common (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-carousel@0.0.1-security as malicious (MAL-2025-49180): Malicious code in epic-react-carousel (npm)

OpenSSF Malicious Packages via OSV confirms epic-react-blog@0.0.1-security as malicious (MAL-2025-49179): Malicious code in epic-react-blog (npm)

OpenSSF Malicious Packages via OSV confirms epic-path-utils@0.0.1-security as malicious (MAL-2025-49178): Malicious code in epic-path-utils (npm)

OpenSSF Malicious Packages via OSV confirms epic-openapi-codegen@0.0.1-security as malicious (MAL-2025-49177): Malicious code in epic-openapi-codegen (npm)

OpenSSF Malicious Packages via OSV confirms epic-okta-express-middleware@0.0.1-security as malicious (MAL-2025-49176): Malicious code in epic-okta-express-middleware (npm)

OpenSSF Malicious Packages via OSV confirms epic-offline-token-verifier-node@0.0.1-security as malicious (MAL-2025-49175): Malicious code in epic-offline-token-verifier-node (npm)

OpenSSF Malicious Packages via OSV confirms epic-node-services-common@0.0.1-security as malicious (MAL-2025-49174): Malicious code in epic-node-services-common (npm)

OpenSSF Malicious Packages via OSV confirms epic-node-services@0.0.1-security as malicious (MAL-2025-49173): Malicious code in epic-node-services (npm)

OpenSSF Malicious Packages via OSV confirms epic-node-purchase@0.0.1-security as malicious (MAL-2025-49171): Malicious code in epic-node-purchase (npm)

OpenSSF Malicious Packages via OSV confirms epic-node-sailthru@0.0.1-security as malicious (MAL-2025-49172): Malicious code in epic-node-sailthru (npm)

OpenSSF Malicious Packages via OSV confirms epic-node-marketo@0.0.1-security as malicious (MAL-2025-49170): Malicious code in epic-node-marketo (npm)

OpenSSF Malicious Packages via OSV confirms epic-node-ecom-services@0.0.1-security as malicious (MAL-2025-49169): Malicious code in epic-node-ecom-services (npm)