Skip to main content

Threat feed Threat types How it works Policy

Threat feed Threat types How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 467 | LPM Firewall

npm threat feed

npm advisory reports, with evidence.

Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 467

Updated 23 Oct 2026, 18:16 UTC. Ordered by latest scan.

cursed-modules@999.0.4

OpenSSF/OSV malware advisory MAL-2026-6698 blocks this version. cursed-modules@999.0.9 executes attacker-controlled code on three separate triggers and operates a bidirectional command ch...

Malware2026-07-01 19:50

neon-poly-utls@1.3.1

OpenSSF/OSV malware advisory MAL-2026-10089 blocks this version. The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/con...

Malware2026-07-01 19:46

svgson-lite@1.0.4

OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...

Malware2026-07-01 19:35

svgson-lite@1.0.2

OpenSSF/OSV malware advisory MAL-2026-6707 blocks this version. index.js exports an undocumented getPlugin() function which, when invoked, performs an HTTP GET to https://shorturl.at/147u...

Malware2026-07-01 19:35

vue-demi-fix@10.0.5

OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...

Malware2026-07-01 19:35

vue-demi-fix@10.0.3

OpenSSF/OSV malware advisory MAL-2026-6702 blocks this version. vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall an...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.11

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

base58-core@1.0.6

OpenSSF/OSV malware advisory MAL-2026-6445 blocks this version. The package advertises itself as a Base58 encoder/decoder but on require() schedules a delayed payload that performs multip...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.10

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.9

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.8

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.7

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.6

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.5

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.4

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.3

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.2

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.4.0

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

hardhat-compile-ethers@0.0.1

OpenSSF/OSV malware advisory MAL-2026-6705 blocks this version. The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/imp...

Malware2026-07-01 19:35

ts-linting-builder@2.1.2

OpenSSF/OSV malware advisory MAL-2026-6678 blocks this version. On npm install, the package's postinstall script (test.js) invokes routines in index.js that recursively scan the current w...

Malware2026-07-01 19:35

hardhat-plugin-solidity@2.3.1

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

Malware2026-07-01 19:35

hardhat-plugin-solidity@2.0.0

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

Malware2026-07-01 19:35

hardhat-plugin-solidity@1.1.0

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

Malware2026-07-01 19:35

ts-lint-builders-v2.1@2.1.0

OpenSSF/OSV malware advisory MAL-2026-6677 blocks this version. On `npm install`, the package's postinstall hook (`node test.js`) executes a multi-stage attack against the installer. (1)...

Malware2026-07-01 19:35

hardhat-plugin-solidity@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6706 blocks this version. Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hard...

Malware2026-07-01 19:35

showing 11651-11675 of 16723