@newspage/libx-amount@99.99.4
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 7d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17873 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package has no active install hook, but its root entrypoint makes an automatic request to a fixed external host. This leaves a real, unresolved runtime disclosure risk, while the inspected target source does not establish a concrete malicious payload or purpose.
Independent scan evidence
public snapshot- The package defines empty preinstall and postinstall commands.
- The root entrypoint sends an HTTPS GET to `/async` when its code runs.
- The target entrypoint sets the request host to `accenture-npm.azurewebsites.net`.
- The investigation evidence identifies the supplemental snapshots as files not shipped in the target archive.
- The related snapshot reads host and user environment variables, but that behavior is not present in the target entrypoint.
- The target request is a GET with no explicit host, user, or other identifying data in its URL or request body.
- The target package has no active preinstall or postinstall command.
Source & flagged code
10 flagged · loading sourceIndependent evidence contains separately hash/SRI-verified related snapshots, not target-shipped files. Inspect their source to assess callback purpose and activation; no verdict is implied.
.lpm-investigation-context/evidence.jsonView on unpkgReview focus: Node CommonJS falls back to root index.js when main points to a missing file and exports is absent. An invalid main string does not alone make index.js inert.
package.jsonView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @newspage/libx-amount@99.99.4.
See all versions of @newspage/libx-amount for other recorded verdicts.
- Avoid installing @newspage/libx-amount@99.99.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.