Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 543 | LPM Firewall

npm threat feed

npm malware reports, with evidence.

Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 543

Updated 23 Oct 2026, 12:27 UTC. Ordered by latest scan.

claude-cup@0.4.1

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

Malware2026-06-30 15:00

claude-cup@0.4.0

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

Malware2026-06-30 15:00

ltidiconf@99.9.1

OpenSSF/OSV malware advisory MAL-2026-5767 blocks this version. ltidiconf@99.9.1 is an empty wrapper package (index.js is `module.exports = {};`, empty author/description, inflated 99.9.1...

Malware2026-06-30 15:00

claude-cup@0.3.1

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

Malware2026-06-30 15:00

claude-cup@0.3.0

OpenSSF/OSV malware advisory MAL-2026-5789 blocks this version. On first invocation of `npx claude-cup` (and on every subsequent Claude Code tool call once hooks are installed), `research...

Malware2026-06-30 15:00

@kalipto/local@1.0.3

OpenSSF/OSV malware advisory MAL-2026-5922 blocks this version. The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto...

Malware2026-06-30 15:00

@zynkit/jwtbytes@0.5.2

OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...

Malware2026-06-30 15:00

@tinyfox/shapecheck@0.8.6

OpenSSF/OSV malware advisory MAL-2026-6312 blocks this version. @tinyfox/shapecheck (malicious version 0.8.7, published by tinyfox-yjwiqz@wshu.net) is a trojanized npm package belonging t...

Malware2026-06-30 15:00

@thymelab/logfx@2.15.4

OpenSSF/OSV malware advisory MAL-2026-6311 blocks this version. @thymelab/logfx (malicious version 2.15.5, published by thymelab-v0et8w@wshu.net) is a trojanized npm package belonging to...

Malware2026-06-30 15:00

@petitcode/eb-retry@1.3.4

OpenSSF/OSV malware advisory MAL-2026-6310 blocks this version. @petitcode/eb-retry (malicious version 1.3.5, published by petitcode-eq1efk@wshu.net) is a trojanized npm package belonging...

Malware2026-06-30 15:00

@lazyutil/dater@0.9.3

OpenSSF/OSV malware advisory MAL-2026-6308 blocks this version. @lazyutil/dater (malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by lazyutil-78muyg@wshu.net) is a trojanized...

Malware2026-06-30 15:00

@glitchpad/throttler@2.2.2

OpenSSF/OSV malware advisory MAL-2026-6307 blocks this version. @glitchpad/throttler (malicious version 2.2.3, published by glitchpad-revqgz@wshu.net) is a trojanized npm package belongin...

Malware2026-06-30 15:00

@frostnode/waitfor@0.10.4

OpenSSF/OSV malware advisory MAL-2026-6305 blocks this version. @frostnode/waitfor (malicious versions 0.9.0, 0.10.3, 0.10.4, and 0.10.5, published by frostnode-gk8pbf@wshu.net) is a troj...

Malware2026-06-30 15:00

@chunklab/hexparse@1.1.5

OpenSSF/OSV malware advisory MAL-2026-6214 blocks this version. Package advertises itself as a small hex/base64/endianness codec library, but every exported encode/decode function (encode...

Malware2026-06-30 15:00

@bytemend/mfebus@1.4.1

OpenSSF/OSV malware advisory MAL-2026-6213 blocks this version. The package advertises itself as a small in-memory pubsub library but its main entry `dist/index.js` eagerly `require()`s `...

Malware2026-06-30 15:00

@briskforge/envcheck@0.5.3

OpenSSF/OSV malware advisory MAL-2026-6212 blocks this version. The package advertises itself as a tiny environment-variable validator but ships lib/preflight.js, a heavily obfuscated (ob...

Malware2026-06-30 15:00

@apexcraft/nano-key@1.3.3

OpenSSF/OSV malware advisory MAL-2026-6210 blocks this version. @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator (README and repository metadata are copied from yi...

Malware2026-06-30 15:00

@kalipto/local@1.0.2

OpenSSF/OSV malware advisory MAL-2026-5922 blocks this version. The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto...

Malware2026-06-30 15:00

@kalipto/local@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5922 blocks this version. The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto...

Malware2026-06-30 15:00

@kalipto/local@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5922 blocks this version. The package is a purpose-built remote-control agent. On startup (when the bin is invoked with `--token`, e.g. `npx @kalipto...

Malware2026-06-30 15:00

index-ulid@3.0.4

OpenSSF/OSV malware advisory MAL-2026-5827 blocks this version. index-ulid impersonates the legitimate `ulid`/`ulidx` ULID generator (reuses ulid's description and links its homepage to g...

Malware2026-06-30 15:00

@zynkit/jwtbytes@0.5.1

OpenSSF/OSV malware advisory MAL-2026-6313 blocks this version. @zynkit/jwtbytes (malicious version 0.5.3, published by zynkit-sk393b@wshu.net) is a trojanized npm package belonging to th...

Malware2026-06-30 15:00

@tinyfox/shapecheck@0.8.5

OpenSSF/OSV malware advisory MAL-2026-6312 blocks this version. @tinyfox/shapecheck (malicious version 0.8.7, published by tinyfox-yjwiqz@wshu.net) is a trojanized npm package belonging t...

Malware2026-06-30 15:00

@lazyutil/dater@0.9.2

OpenSSF/OSV malware advisory MAL-2026-6308 blocks this version. @lazyutil/dater (malicious versions 0.8.1, 0.9.2, 0.9.3, and 0.9.4, published by lazyutil-78muyg@wshu.net) is a trojanized...

Malware2026-06-30 15:00

@glitchpad/throttler@2.2.1

OpenSSF/OSV malware advisory MAL-2026-6307 blocks this version. @glitchpad/throttler (malicious version 2.2.3, published by glitchpad-revqgz@wshu.net) is a trojanized npm package belongin...

Malware2026-06-30 15:00

showing 13551-13575 of 18026