Skip to main content

Threat feed Threat types How it works Policy

Threat feed Threat types How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 581 | LPM Firewall

npm threat feed

npm malware reports, with evidence.

Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 581

Updated 24 Oct 2026, 11:18 UTC. Ordered by latest scan.

@jaggle/resizeobserves@1.0.15

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

codebuff-cli@1.1.6

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

Malware2026-06-30 15:00

@jaggle/resizeobserves@1.0.14

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

codebuff-cli@1.1.5

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

Malware2026-06-30 15:00

@jaggle/resizeobserves@1.0.13

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

@jaggle/resizeobserves@1.0.12

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

claw-subagent-service@0.0.141

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

Malware2026-06-30 15:00

claw-subagent-service@0.0.140

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

Malware2026-06-30 15:00

claw-subagent-service@0.0.138

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

Malware2026-06-30 15:00

claw-subagent-service@0.0.137

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

Malware2026-06-30 15:00

claw-subagent-service@0.0.136

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

Malware2026-06-30 15:00

codebuff-cli@1.1.4

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

Malware2026-06-30 15:00

claw-subagent-service@0.0.130

OpenSSF/OSV malware advisory MAL-2026-3757 blocks this version. On `npm install -g`, the package's `scripts/post-install.js` registers a privileged Windows service `claw-subagent-service`...

Malware2026-06-30 15:00

@zizie071/libsignal-node@3.4.6

OpenSSF/OSV malware advisory MAL-2026-4473 blocks this version. On require(), index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overw...

Malware2026-06-30 15:00

codebuff-cli@1.1.2

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

Malware2026-06-30 15:00

@zizie071/libsignal-node@3.3.6

OpenSSF/OSV malware advisory MAL-2026-4473 blocks this version. On require(), index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overw...

Malware2026-06-30 15:00

fnd-stores@0.0.7

OpenSSF/OSV malware advisory MAL-2026-4565 blocks this version. On `npm install`, the package's postinstall hook runs `node index.js`, which collects the installer's hostname, OS platform...

Malware2026-06-30 15:00

@jaggle/resizeobserves@1.0.11

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

@stockrepublic/republic-components@100.0.0

OpenSSF/OSV malware advisory MAL-2026-4289 blocks this version. The package masquerades as an internal @stockrepublic component (version 99.0.0, description 'Runs git diff and saves the o...

Malware2026-06-30 15:00

@jaggle/resizeobserves@1.0.10

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

@stockrepublic/republic-components@99.0.0

OpenSSF/OSV malware advisory MAL-2026-4289 blocks this version. The package masquerades as an internal @stockrepublic component (version 99.0.0, description 'Runs git diff and saves the o...

Malware2026-06-30 15:00

@jaggle/resizeobserves@1.0.9

OpenSSF/OSV malware advisory MAL-2026-4288 blocks this version. Package name impersonates the popular @juggle/resize-observer (j→j substitution and pluralized 'resizeobserves') and the RE...

Malware2026-06-30 15:00

class-weaver@1.0.0

OpenSSF/OSV malware advisory MAL-2026-4521 blocks this version. class-weaver advertises itself as a className/theme utility (keywords clsx, utils, styling; exports named classNames and tw...

Malware2026-06-30 15:00

codebuff-cli@1.1.1

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

Malware2026-06-30 15:00

codebuff-cli@1.1.0

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

Malware2026-06-30 15:00

showing 14501-14525 of 18062