Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 548 | LPM Firewall

npm threat feed

npm malware reports, with evidence.

Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 548

Updated 22 Oct 2026, 23:23 UTC. Ordered by latest scan.

autoheal-dev-cli@1.2.9

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.2.7

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.2.6

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.2.5

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.0.9

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

showing 13676-13700 of 16686

Malware

2026-06-30 15:00

autoheal-dev-cli@1.0.7

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.0.6

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.0.5

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

autoheal-dev-cli@1.0.4

OpenSSF/OSV malware advisory MAL-2026-4492 blocks this version. autoheal-dev-cli is a setup wizard (`bin/setup.js`) that, when run, performs three installer-harm actions against the devel...

Malware2026-06-30 15:00

authcascade@1.5.26

OpenSSF/OSV malware advisory MAL-2026-4491 blocks this version. On require('authcascade'), the package's main entry pino.js loads lib/writer.js which (a) builds a data object containing t...

Malware2026-06-30 15:00

authcascade@1.5.25

OpenSSF/OSV malware advisory MAL-2026-4491 blocks this version. On require('authcascade'), the package's main entry pino.js loads lib/writer.js which (a) builds a data object containing t...

Malware2026-06-30 15:00

auth0.net@7.22.1

OpenSSF/OSV malware advisory MAL-2024-1783 blocks this version. OSV/OpenSSF confirms auth0.net@7.22.1 as malicious package MAL-2024-1783. Malicious code in auth0.net (npm)

Malware2026-06-30 15:00

auth0.net@39.1.0

OpenSSF/OSV malware advisory MAL-2024-1783 blocks this version. OSV/OpenSSF confirms auth0.net@39.1.0 as malicious package MAL-2024-1783. Malicious code in auth0.net (npm)

Malware2026-06-30 15:00

auth0-templates-scripts-utils@1.0.5

OpenSSF/OSV malware advisory MAL-2026-4490 blocks this version. Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install`...

Malware2026-06-30 15:00

auth0-templates-scripts-utils@1.0.4

OpenSSF/OSV malware advisory MAL-2026-4490 blocks this version. Package name impersonates the Auth0 ecosystem. Its postinstall hook (`node index.js`) runs unconditionally on `npm install`...

Malware2026-06-30 15:00

auth0-templates-scripts@80.0.4

OpenSSF/OSV malware advisory MAL-2026-4489 blocks this version. Package name 'auth0-templates-scripts' impersonates the Auth0 (Okta) brand without affiliation. The author field is the pla...

Malware2026-06-30 15:00

auth0-templates-scripts@80.0.1

OpenSSF/OSV malware advisory MAL-2026-4489 blocks this version. Package name 'auth0-templates-scripts' impersonates the Auth0 (Okta) brand without affiliation. The author field is the pla...

Malware2026-06-30 15:00

auth-javascript@0.0.17

OpenSSF/OSV malware advisory MAL-2026-3648 blocks this version. Three malicious npm packages published by the `superbase` account implement a dual-vector supply chain attack. Each package...

Malware2026-06-30 15:00

auth-basic-vault@1.1.5

OpenSSF/OSV malware advisory MAL-2026-4488 blocks this version. On require('auth-basic-vault'), lib/writer.js attempts to require('authcascade') at module top level and, on failure, shell...

Malware2026-06-30 15:00

atomic-notes@0.5.3

OpenSSF/OSV malware advisory MAL-2026-4486 blocks this version. package.json declares `preinstall:./.github/scripts/precheck`, which executes a 976 KB stripped, UPX-packed Linux x86_64 EL...

Malware2026-06-30 15:00

atlassian-forge-skills@29.1.0

OpenSSF/OSV malware advisory MAL-2026-5891 blocks this version. Package impersonates an internal Atlassian Forge dependency (unscoped name `atlassian-forge-skills`, description 'Internal...

Malware2026-06-30 15:00

atlasora-api@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6237 blocks this version. Package declares a postinstall hook ("postinstall": "node install.js") that runs install.js automatically on `npm install`....

Malware2026-06-30 15:00

atlasora-client@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6238 blocks this version. package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https,...

Malware2026-06-30 15:00

atlasora-config@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6239 blocks this version. The package declares a postinstall hook in package.json ("postinstall": "node install.js") that auto-executes install.js on...

Malware2026-06-30 15:00

atlasora-utils@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6243 blocks this version. On `npm install`, the package's postinstall hook (`node install.js`, declared in package.json) harvests secrets from the in...

Malware2026-06-30 15:00