npm

o0o9 @2.0.1

Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 12:52 PM UTC

Malicious

OSV ID

MAL-2026-14277

Ecosystem

npm

Summary

The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a top-level side effect (line 27). Loading the module via require/import causes an unprompted PowerShell process to launch on the installer's machine, which is a Windows-focused code execution vector wholly unrelated to any legitimate library function. This is the shape of an install/import-time execution payload rather than an API a caller must opt into.

Source: amazon-inspector (a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.