npm scope

@cashback

LPM Firewall blocks 3 packages in the @cashback npm scope.

Jul 9, 2026

@cashback/auth@99.9.9

OpenSSF Malicious Packages via OSV confirms @cashback/auth@99.9.9 as malicious (MAL-2026-7058): Malicious code in @cashback/auth (npm)

Jul 9, 2026

@cashback/how-it-works-widget@99.9.9

Malware

OpenSSF Malicious Packages via OSV confirms @cashback/how-it-works-widget@99.9.9 as malicious (MAL-2026-7059): Malicious code in @cashback/how-it-works-widget (npm)

Jul 9, 2026

@cashback/postal-premium@99.9.9

Malware

OpenSSF Malicious Packages via OSV confirms @cashback/postal-premium@99.9.9 as malicious (MAL-2026-7060): Malicious code in @cashback/postal-premium (npm)