npm scope
@httttt
LPM Firewall blocks 2 packages in the @httttt npm scope. 2 have LPM's own review and are listed first.
Sep 23, 2026
@httttt/mcp-demo@1.1.0
MalwareOpenSSF Malicious Packages via OSV confirms @httttt/mcp-demo@1.1.0 as malicious (MAL-2026-14315): Malicious code in @httttt/mcp-demo (npm)
Aug 20, 2026
@httttt/mcp-npx-fetch-1@1.0.0
Remote code executionSource inspection confirms a package script retrieves and executes an unauditable remote payload. The normal MCP server code does not justify that behavior.
Each card opens the package page with its evidence and every recorded version.