npm advisory reports, with evidence.

The package performs an unconsented, remotely controlled account mutation through its normal runtime entrypoint. This is concrete malicious behavior and warrants blocking publication.

The sole published entrypoint contains direct browser-cookie exfiltration to an unrelated webhook endpoint. This is concrete malicious behavior rather than a package-aligned client request.

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.

The package uses automatic install hooks solely to make an external request to an unrelated endpoint. Although no credential theft or local mutation was found, this is concrete unsolicite...

OpenSSF Malicious Packages via OSV confirms npmscript_tesstalert_unpkg@1.1.7 as malicious (MAL-2026-16309): Malicious code in npmscript_tesstalert_unpkg (npm)

OpenSSF Malicious Packages via OSV confirms @uol-afiliados/affiliated-config-lib@102.0.0 as malicious (MAL-2026-16370): Malicious code in @uol-afiliados/affiliated-config-lib (npm)

OpenSSF Malicious Packages via OSV confirms my-ctf-helper-script-9921@1.0.0 as malicious (MAL-2026-16365): Malicious code in my-ctf-helper-script-9921 (npm)

OpenSSF Malicious Packages via OSV confirms blue-string-formatter-utilss@1.2.0 as malicious (MAL-2026-16363): Malicious code in blue-string-formatter-utilss (npm)

OpenSSF Malicious Packages via OSV confirms bytepack-probe-a7x3@1.0.1 as malicious (MAL-2026-16364): Malicious code in bytepack-probe-a7x3 (npm)

OpenSSF Malicious Packages via OSV confirms bytepack-probe-a7x3@1.0.0 as malicious (MAL-2026-16364): Malicious code in bytepack-probe-a7x3 (npm)

OpenSSF Malicious Packages via OSV confirms @asdfaskdjfksadhfkasf/nadaver2@102.0.0 as malicious (MAL-2026-16357): Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

OpenSSF Malicious Packages via OSV confirms @uh-platform/nadaver2@102.0.0 as malicious (MAL-2026-16361): Malicious code in @uh-platform/nadaver2 (npm)

OpenSSF Malicious Packages via OSV confirms @uh-platform/nadaver@102.0.0 as malicious (MAL-2026-16360): Malicious code in @uh-platform/nadaver (npm)

OpenSSF Malicious Packages via OSV confirms @uh-platform/cloud@101.0.0 as malicious (MAL-2026-16358): Malicious code in @uh-platform/cloud (npm)

OpenSSF Malicious Packages via OSV confirms @uh-platform/webcard@99.0.0 as malicious (MAL-2026-16362): Malicious code in @uh-platform/webcard (npm)

This is a concrete install-time reconnaissance and data-exfiltration path to an unrelated fixed endpoint. It is malicious install-hook abuse, not package-aligned setup.

This is concrete import-time environment exfiltration followed by remotely supplied code execution. The lack of an install hook does not reduce the risk to consumers that load the package.

This is concrete concealed code execution, not environment configuration behavior. The automatic entrypoint calls and hidden encoded PowerShell launcher warrant blocking publication.

This package embeds an import-time backdoor that overwrites a foreign dependency and remotely directs authenticated newsletter follows. The absence of an npm lifecycle script does not rem...

The package contains a concrete import-time backdoor that mutates a third-party dependency and remotely directs authenticated account actions. The absence of an npm lifecycle hook does no...

OpenSSF Malicious Packages via OSV confirms epic-adminportal-frontend@0.0.1-security as malicious (MAL-2025-49114): Malicious code in epic-adminportal-frontend (npm)