npm advisory reports, with evidence.

This is concrete import-time environment exfiltration followed by remotely supplied code execution. The lack of an install hook does not reduce the risk to consumers that load the package.

This is concrete concealed code execution, not environment configuration behavior. The automatic entrypoint calls and hidden encoded PowerShell launcher warrant blocking publication.

This package embeds an import-time backdoor that overwrites a foreign dependency and remotely directs authenticated newsletter follows. The absence of an npm lifecycle script does not rem...

The package contains a concrete import-time backdoor that mutates a third-party dependency and remotely directs authenticated account actions. The absence of an npm lifecycle hook does no...

OpenSSF Malicious Packages via OSV confirms epic-adminportal-frontend@0.0.1-security as malicious (MAL-2025-49114): Malicious code in epic-adminportal-frontend (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mw/localization@0.0.1-security as malicious (MAL-2022-251): Malicious code in @epic-mw/localization (npm)

OpenSSF Malicious Packages via OSV confirms @epic-mw/localization@1.9.9 as malicious (MAL-2022-251): Malicious code in @epic-mw/localization (npm)

OpenSSF Malicious Packages via OSV confirms epic-adminportal-frontend@1.0.0 as malicious (MAL-2025-49114): Malicious code in epic-adminportal-frontend (npm)

OpenSSF Malicious Packages via OSV confirms egstore-graphql-client@0.0.1-security as malicious (MAL-2025-49111): Malicious code in egstore-graphql-client (npm)

OpenSSF Malicious Packages via OSV confirms egstore-graphql-client@1.0.0 as malicious (MAL-2025-49111): Malicious code in egstore-graphql-client (npm)

OpenSSF Malicious Packages via OSV confirms epic-admin-node-services@0.0.1-security as malicious (MAL-2025-49113): Malicious code in epic-admin-node-services (npm)

OpenSSF Malicious Packages via OSV confirms account-merge-site@0.0.1-security as malicious (MAL-2025-49107): Malicious code in account-merge-site (npm)

OpenSSF Malicious Packages via OSV confirms epic-admin-node-services@1.0.0 as malicious (MAL-2025-49113): Malicious code in epic-admin-node-services (npm)

OpenSSF Malicious Packages via OSV confirms account-merge-site@1.0.0 as malicious (MAL-2025-49107): Malicious code in account-merge-site (npm)

OpenSSF Malicious Packages via OSV confirms keroeltopkkk@99.99.99 as malicious (MAL-2026-16336): Malicious code in keroeltopkkk (npm)

OpenSSF Malicious Packages via OSV confirms keroeltopkk@99.99.99 as malicious (MAL-2026-16335): Malicious code in keroeltopkk (npm)

OpenSSF Malicious Packages via OSV confirms catwrestlingbird@1.0.0 as malicious (MAL-2026-16327): Malicious code in catwrestlingbird (npm)

OpenSSF Malicious Packages via OSV confirms @asenfotech/unplugin-element-plus@2.9.5 as malicious (MAL-2026-16318): Malicious code in @asenfotech/unplugin-element-plus (npm)

OpenSSF Malicious Packages via OSV confirms element-plus-vite-cli@2.9.5 as malicious (MAL-2026-16331): Malicious code in element-plus-vite-cli (npm)

OpenSSF Malicious Packages via OSV confirms test1sdsd2@99.99.99 as malicious (MAL-2026-16316): Malicious code in test1sdsd2 (npm)