Malicious code in o0o9 (npm)

The npm package o0o9 was found to contain malicious code designed to execute arbitrary commands on Windows systems. Upon import or require of the module, the package's main entry point (index.js) would immediately spawn a PowerShell process as a top-level side effect, independent of any legitimate library functionality.\n\nThe malicious behavior was triggered at line 27 of index.js, where the child_process module was imported and spawn() was invoked with PowerShell as the target. This represents an install-time or import-time execution payload rather than an optional API call, meaning any developer who installed and loaded the package would trigger the malicious code without explicit action.\n\nThe vulnerability was particularly dangerous on Windows systems, where PowerShell execution could be leveraged for further compromise. The malicious package was identified and reported through the OpenSSF's malicious-packages repository (MAL-2026-14277).\n\nThe package has been removed from npm and the incident is considered resolved.