npm scope
@fastify-core
LPM Firewall blocks 2 packages in the @fastify-core npm scope. 2 have LPM's own review and are listed first.
Aug 23, 2026
@fastify-core/single@1.0.6
Install hook abuseThis is concrete unconsented install-time mutation of a foreign project manifest, concealed in a detached delayed child process. No exfiltration was found, but the dependency-injection be...
Aug 23, 2026
@fastify-core/base@1.0.2
Dependency confusionThe package performs concealed, unconsented modification of a foreign project manifest during postinstall. No network or credential theft was found, but dependency injection alone is conc...
Each card opens the package page with its evidence and every recorded version.