Skip to main content

Threat feed Threat types Research How it works Policy

Threat feed Threat types Research How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 715 | LPM Firewall

npm threat feed

npm malware reports, with evidence.

Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 715

Updated 27 Oct 2026, 23:34 UTC. Ordered by latest scan.

metrics-pipeline-d8k2@1.0.18

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.17

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.16

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.15

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.14

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.13

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.12

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.11

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.10

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

metrics-pipeline-d8k2@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5858 blocks this version. Package declares `"postinstall": "node run.js"` in package.json, causing automatic execution of bundled beacon scripts on `...

Malware2026-06-30 15:00

mjs-eslint-helper@4.0.1

OpenSSF/OSV malware advisory MAL-2026-6190 blocks this version. The package decodes base64 string literals via Buffer.from(..., 'base64').toString() and pipes the resulting content into e...

Malware2026-06-30 15:00

mcp-echarts@0.9.1

OpenSSF/OSV malware advisory MAL-2026-4146 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

Malware2026-06-30 15:00

mcp-echarts@0.8.1

OpenSSF/OSV malware advisory MAL-2026-4146 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

Malware2026-06-30 15:00

mcp-mermaid@0.6.1

OpenSSF/OSV malware advisory MAL-2026-4147 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

Malware2026-06-30 15:00

mcp-mermaid@0.5.1

OpenSSF/OSV malware advisory MAL-2026-4147 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

Malware2026-06-30 15:00

mimecast-web-components@2.0.0

OpenSSF/OSV malware advisory MAL-2026-3618 blocks this version. The OpenSSF Package Analysis project identified 'mimecast-web-components' @ 2.0.0 (npm) as malicious.

Malware2026-06-30 15:00

OpenSSF/OSV malware advisory MAL-2026-4610 blocks this version. The package masquerades as a pino-compatible logger (package.json keywords `fast`/`logger`/`stream`/`json`, exports `module...

Malware2026-06-30 15:00

OpenSSF/OSV malware advisory MAL-2026-4611 blocks this version. The package advertises a logger middleware (keywords fast/logger/stream/json, exports `module.exports.pino = middleware`, f...

Malware2026-06-30 15:00

microsoft-applicationinsights-common@3.4.2

OpenSSF/OSV malware advisory MAL-2026-3650 blocks this version. Two malicious npm packages published by the `micresoft` account (typosquatting "microsoft") are part of a coordinated suppl...

Malware2026-06-30 15:00

OpenSSF/OSV malware advisory MAL-2026-4148 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

Malware2026-06-30 15:00

OpenSSF/OSV malware advisory MAL-2026-4148 blocks this version. Part of the **Mini Shai-Hulud** supply chain attack campaign in which a threat actor compromised the npm account `atool` an...

Malware2026-06-30 15:00

martinez-polygon-clipping-tony@0.9.5

OpenSSF/OSV malware advisory MAL-2026-4606 blocks this version. Package name impersonates the legitimate martinez-polygon-clipping library: README, badges, and API surface are copied verb...

Malware2026-06-30 15:00

markdownlint-cli2-fix@99.0.7

OpenSSF/OSV malware advisory MAL-2026-6353 blocks this version. Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionali...

Malware2026-06-30 15:00

markdownlint-cli2-fix@99.0.6

OpenSSF/OSV malware advisory MAL-2026-6353 blocks this version. Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionali...

Malware2026-06-30 15:00

showing 17851-17875 of 18223