Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

poc-ch4rlygr@1.6.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 6 finding(s) warrant review before installing.

View on npm All versions

registry / poc-ch4rlygr / 1.6.0

poc-ch4rlygr@1.6.0

OSV Malicious Advisory

scanned 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13454 confirms this npm version as malicious.

Advisory

MAL-2026-13454

Source

OpenSSF Malicious Packages via OSV

Decision reason

One or more suspicious static signals were detected.

References

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.76 KB of source

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

72%Warn

Verdict confidence

TypeMalware

Firewall policyMatched warn-list

Behavioral surface

ChildProcessEnvironmentVarsNetworkHighEntropyStringsManifest: clean

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

LPM CLI

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg