Loading npm security reports…
Skip to main contentDependency Confusion2026-09-26 07:40Dependency Confusion2026-08-23 12:18Dependency Confusion2026-08-19 22:53Dependency Confusion2026-07-31 22:57
npm threat feed
npm dependency confusion reports.
Review dependency confusion findings, where a public package can be installed in place of an intended private dependency. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Latest security reports
Updated 8 Oct 2026, 08:48 UTC. Ordered by latest scan.
app-sca-info-banking@0.0.24
The package performs unsolicited external callbacks during installation through a postinstall hook. This is concrete dependency-confusion install tracking and warrants blocking.
@fastify-core/base@1.0.2
The package performs concealed, unconsented modification of a foreign project manifest during postinstall. No network or credential theft was found, but dependency injection alone is conc...
randompkga@1.0.17
The package's only observable behavior is an unconsented postinstall mutation of the consumer project to inject another dependency. This is a concrete supply-chain attack behavior despite...
mx-www-protobuf@1.0.0
This is confirmed unconsented install-time metadata collection and file creation in a package explicitly positioned as a dependency-confusion PoC. Absence of network exfiltration does not...