npm scope

@servicetitan

LPM Firewall blocks 140 packages in the @servicetitan npm scope. 40 have LPM's own review and are listed first.

Aug 4, 2026

@servicetitan/anvil-react@0.11.6

This is concrete install-time execution of an obfuscated credential-oriented remote-code payload, not functionality aligned with a React component library.

Aug 4, 2026

@servicetitan/uikit-docs@22.11.4

Credential exfiltration

The lifecycle execution, downloaded interpreter, obfuscated payload, remote eval, and credential logic form a concrete malicious chain unrelated to documentation delivery.

Aug 4, 2026

@servicetitan/eslint-plugin-decorators-declare@12.8.18

Remote code execution

The benign ESLint rule is accompanied by an unrelated, obfuscated preinstall payload that downloads a runtime, executes it, and evaluates fetched code. This is concrete malicious install-...

Aug 4, 2026

@servicetitan/forge@0.5.4