@hibachi-xyz
LPM Firewall blocks 5 packages in the @hibachi-xyz npm scope. 2 have LPM's own review and are listed first.
This is concrete import-time credential and host-information exfiltration with no package-aligned functionality. The absence of lifecycle hooks does not mitigate execution when consumers...
Source inspection confirms a concrete import-time credential and host-fingerprint exfiltration chain to an unrelated hard-coded endpoint. This is malicious behavior despite the absence of...
OpenSSF Malicious Packages via OSV confirms @hibachi-xyz/sdk@99.0.0 as malicious (MAL-2026-10714): Malicious code in @hibachi-xyz/sdk (npm)
OpenSSF Malicious Packages via OSV confirms @hibachi-xyz/types@99.0.0 as malicious (MAL-2026-10715): Malicious code in @hibachi-xyz/types (npm)
OpenSSF Malicious Packages via OSV confirms @hibachi-xyz/ui@99.0.0 as malicious (MAL-2026-10716): Malicious code in @hibachi-xyz/ui (npm)