Skip to main content

Threat feed Threat types How it works Policy

Threat feed Threat types How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 556 | LPM Firewall

npm threat feed

npm malware reports, with evidence.

Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 556

Updated 23 Oct 2026, 20:08 UTC. Ordered by latest scan.

forge-jsx2@1.0.124

OpenSSF/OSV malware advisory MAL-2026-5568 blocks this version. The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinst...

Malware2026-06-30 15:00

spotify-url-resolver@3.4.2

OpenSSF/OSV malware advisory MAL-2026-5574 blocks this version. On `require('spotify-url-resolver')`, index.js line 21 invokes startBackupLoop() at module top level. The loop zips process...

Malware2026-06-30 15:00

postcss-minify-selector@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

Malware2026-06-30 15:00

testzapier@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5575 blocks this version. package.json declares a preinstall hook (`node index.js`) that fires automatically on `npm install`. index.js spawns a shel...

Malware2026-06-30 15:00

utils-mf@12.1.0

OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...

Malware2026-06-30 15:00

testzapier@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5575 blocks this version. package.json declares a preinstall hook (`node index.js`) that fires automatically on `npm install`. index.js spawns a shel...

Malware2026-06-30 15:00

@dsft/ft-utils@1.5.8

OpenSSF/OSV malware advisory MAL-2026-5890 blocks this version. The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstal...

Malware2026-06-30 15:00

@dsft/ft-element@2.5.9

OpenSSF/OSV malware advisory MAL-2026-5889 blocks this version. On `npm install`, the package's preinstall hook (`preinstall: node index.js` in package.json) executes index.js, which read...

Malware2026-06-30 15:00

postcss-minify-selector@0.1.2

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

Malware2026-06-30 15:00

twilio-sdk@0.2.4

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.4

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.3

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.3

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.2

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.2

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.1

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.1

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.0

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.0

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.1.2

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.1.2

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.1.1

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.1.1

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

showing 13876-13900 of 18039