npm scope
@newspage
LPM Firewall blocks 2 packages in the @newspage npm scope. 2 have LPM's own review and are listed first.
Oct 16, 2026
@newspage/libx-amount@99.99.42
MalwareOpenSSF Malicious Packages via OSV confirms @newspage/libx-amount@99.99.42 as malicious (MAL-2026-17873): Malicious code in @newspage/libx-amount (npm)
Oct 13, 2026
@newspage/lib-ng-async-routes-ui@99.99.42
Data exfiltrationThe source contains an active outbound transfer of host and username identifiers to a hard-coded external endpoint, with no consent guard. Although the manifest does not establish install...
Each card opens the package page with its evidence and every recorded version.