Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

merge-grid-stats@1.4.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 5 finding(s) warrant review before installing.

View on npm All versions

registry / merge-grid-stats / 1.4.0

merge-grid-stats@1.4.0

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13484 confirms this npm version as malicious.

Advisory

MAL-2026-13484

Source

OpenSSF Malicious Packages via OSV

Decision reason

One or more suspicious static signals were detected.

References

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 3.62 KB of source

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-cb.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High1 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

72%Warn

Verdict confidence

TypeMalware

Firewall policyMatched warn-list

Behavioral surface

ChildProcessFilesystemHighEntropyStringsManifest: clean

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

LPM CLI

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node install-cb.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg