npm scope

@qlik

LPM Firewall blocks 28 packages in the @qlik npm scope. 2 have LPM's own review and are listed first.

Aug 4, 2026

@qlik/eslint-config@2.0.20

The install hook is unrelated to an ESLint configuration package and launches a concealed credential-oriented payload. This is concrete malicious behavior, not a noisy static match.

Aug 4, 2026

@qlik/carboncopy@1.1.6

Credential exfiltration

The automatic execution chain and obfuscated token-oriented payload establish concrete malicious install-time behavior. The scaffold CLI and normal template artifacts do not explain it.

Aug 5, 2026

@qlik/api@2.14.2

Malware

OpenSSF Malicious Packages via OSV confirms @qlik/api@2.14.2 as malicious (MAL-2026-11783): Malicious code in @qlik/api (npm)

Aug 5, 2026

@qlik/browserslist-config@3.0.2

Malware

OpenSSF Malicious Packages via OSV confirms @qlik/browserslist-config@3.0.2 as malicious (MAL-2026-11784): Malicious code in @qlik/browserslist-config (npm)