Skip to main content

Threat feed Threat types How it works Policy

Threat feed Threat types How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 496 | LPM Firewall

npm threat feed

npm advisory reports, with evidence.

Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 496

Updated 24 Oct 2026, 11:50 UTC. Ordered by latest scan.

coral-wraith@11.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@10.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

sea-bound-siren@8.0.0

OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...

Malware2026-06-30 15:00

coral-wraith@9.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@8.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@7.0.3

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

sea-bound-siren@7.0.1

OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...

Malware2026-06-30 15:00

coral-wraith@7.0.2

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@7.0.1

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@7.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

requests-middleware@1.0.2

OpenSSF/OSV malware advisory MAL-2026-6096 blocks this version. The package masquerades as a typosquat of the legacy `request`/`requests` HTTP library, copying that project's README, depe...

Malware2026-06-30 15:00

web-model-bridge@9999.99.99

OpenSSF/OSV malware advisory MAL-2026-5697 blocks this version. On `npm install`, postinstall.js sends an HTTPS POST to https://ddactic-lab.online/sc/beacon carrying the package name/vers...

Malware2026-06-30 15:00

gpu-accelerator@1.4.7

OpenSSF/OSV malware advisory MAL-2026-5980 blocks this version. The package advertises itself as a PostCSS plugin for CSS hardware-acceleration hints, but its only legitimate behavior is...

Malware2026-06-30 15:00

vite-react-toolkit@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5701 blocks this version. On import/require of vite-react-toolkit, src/features/extras/config.js (reached via the package main → createConfig.js → fe...

Malware2026-06-30 15:00

uol-simple-api-futebol@4.6.4

OpenSSF/OSV malware advisory MAL-2026-6087 blocks this version. The package's only documented function, getJogos() (default export), unconditionally invokes an internal helper named prepa...

Malware2026-06-30 15:00

coral-wraith@6.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@5.0.3

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@5.0.2

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

coral-wraith@5.0.1

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

sea-bound-siren@4.0.0

OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...

Malware2026-06-30 15:00

coral-wraith@4.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

sea-bound-siren@3.0.0

OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...

Malware2026-06-30 15:00

coral-wraith@3.0.0

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

sea-bound-siren@2.0.4

OpenSSF/OSV malware advisory MAL-2026-5693 blocks this version. On npm install, postinstall.js executes a shell pipeline that collects the output of `id`, `os.hostname()`, the full proces...

Malware2026-06-30 15:00

coral-wraith@2.0.4

OpenSSF/OSV malware advisory MAL-2026-5682 blocks this version. The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the inst...

Malware2026-06-30 15:00

showing 12376-12400 of 16739