npm advisory reports, with evidence.

OpenSSF Malicious Packages via OSV confirms @insiderintelligence/googleadmanager@9.9.10 as malicious (MAL-2026-16290): Malicious code in @insiderintelligence/googleadmanager (npm)

The reachable encrypted decrypt-and-require chain is a concrete hidden code-execution mechanism. Absence of an install hook does not remove the runtime execution risk.

Source shows a fake Cloudflare interstitial whose obfuscated script fetches, AES-decrypts, and follows a remote redirect_url. That is concrete malware behavior even though npm install its...

Source is a complete fake Cloudflare challenge that hides a remote fetch, AES-CTR decrypt, and URL redirect behind obfuscation. That is a working browser malware loader even though npm in...

Source is a fake Cloudflare challenge whose obfuscated script fetches, AES-CTR decrypts, and Function-executes a remote payload, then redirects the visitor. That is a concrete browser rem...

Source shows a random-named HTML dropper that impersonates Cloudflare, contacts a reconstructed API, decrypts the reply, and executes it with Function. That is a concrete browser remote-c...

Source shows a fake Cloudflare challenge page whose only job is to gate a fetch, AES-decrypt a destination, and redirect the browser. That is concrete malware behavior even though npm ins...

Source shows a fake Cloudflare interstitial whose obfuscated script fetches, decrypts, and Function-executes a remote payload. Missing install hooks only means npm will not auto-open the...

OpenSSF Malicious Packages via OSV confirms x509-escaping@1.0.1 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms tailwindcss-forms-ui@0.5.2 as malicious (MAL-2026-16295): Malicious code in tailwindcss-forms-ui (npm)

OpenSSF Malicious Packages via OSV confirms x509-escaping@0.0.2 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms x509-escaping@0.0.1 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms x509-escaping@0.0.0 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

OpenSSF Malicious Packages via OSV confirms @shared-runtime/modules@9.9.10 as malicious (MAL-2026-16291): Malicious code in @shared-runtime/modules (npm)

OpenSSF Malicious Packages via OSV confirms @shared-web/utils@9.9.10 as malicious (MAL-2026-16292): Malicious code in @shared-web/utils (npm)

index.js is a reverse-shell dropper on the published main export, with check.js and CI invoking it. That is concrete remote code execution, not dual-use tooling.

OpenSSF Malicious Packages via OSV confirms test89-auth@1.0.1 as malicious (MAL-2026-16288): Malicious code in test89-auth (npm)

OpenSSF Malicious Packages via OSV confirms test890-auth@1.0.0 as malicious (MAL-2026-16289): Malicious code in test890-auth (npm)

The cheerleading metadata is cover: the ESM entry and extra source files execute obfuscated load-time code that overlays a fake Stripe payment iframe on checkout pages. That is a concrete...

The default socket path includes a hidden delayed fetch of a maintainer-controlled channel list and an automatic follow loop against the user's WhatsApp session. That is unconsented accou...