npm advisory reports, with evidence.

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1338.3 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1338.2 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1338.1 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1337.8 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1337.7 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1337.5 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.1337.1 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.0.5 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

OpenSSF Malicious Packages via OSV confirms @nimbusedge/auth@19999.0.2 as malicious (MAL-2026-16132): Malicious code in @nimbusedge/auth (npm)

This is a concealed install-time remote code execution chain, not functionality required for a glob matcher. The automatic execution, opaque payload retrieval, evaluation, and cleanup est...

The package uses automatic lifecycle hooks to stage, execute, and erase a concealed remote payload. This is concrete malicious install-hook abuse.

The only package source defines an automatic preinstall hook that establishes a remote interactive shell and performs external data posting. This is concrete install-time malware behavior.

The sole install-time script is an explicit reverse-shell command with external output forwarding. This is concrete malicious behavior activated without user interaction beyond installation.

The install-time hook contains concrete remote-shell behavior, not a package-aligned setup action. This is malicious install-hook abuse.

The sole lifecycle script implements an install-time reverse shell and sends its output externally. This is concrete malicious behavior, not package setup.

This is a concrete automatic install-time data-exfiltration chain with no corresponding package functionality. The suppressed-error preinstall hook runs reconnaissance commands and sends...

This is concrete, unconsented install-time system reconnaissance and data exfiltration with no legitimate runtime implementation. The package should be blocked.

This is an automatic install-time reconnaissance and data-exfiltration payload with no corresponding package functionality. The lifecycle hook suppresses failures while harvesting and tra...

This is concrete, unconsented install-time host profiling and exfiltration to an unrelated external endpoint. The automatic lifecycle trigger and identity-command collection make the pack...

This is an automatic install-time host and identity-data exfiltration path with no package functionality that requires it. The empty runtime module does not justify the lifecycle behavior.