Threats Tagged 'mal-2026-10316'

The npm package 'ishowfeet14' contains malicious code that facilitates mass publication of nearly 100 similarly named packages by rewriting package names and republishing automatically. It includes a browser Service Worker that serves a heavily obfuscated web proxy frontend with a hidden popunder redirect to a malicious site. The package does not execute code during Node.js installation, so the compromise occurs only when the browser loads the static assets, resulting in registry abuse and browser-side malicious behavior. The package is flagged for namespace abuse and considered critical due to potential full system compromise if installed.