npm scope
@mexc
LPM Firewall blocks 2 packages in the @mexc npm scope. 2 have LPM's own review and are listed first.
Jul 31, 2026
@mexc/ws@1.0.1
MalwareSource inspection confirms a postinstall side effect that collects local metadata and writes it outside the package, aligned with the package's dependency-confusion PoC description. Absen...
Jul 31, 2026
@mexc/shared-utils@2.0.0
Dependency confusionThe package has an unconsented postinstall that collects system/user data and mutates the filesystem, explicitly presented as dependency-confusion proof behavior. No exfiltration endpoint...
Each card opens the package page with its evidence and every recorded version.