Skip to main content

Threat feed Threat types How it works Policy

Threat feed Threat types How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 504 | LPM Firewall

npm threat feed

npm advisory reports, with evidence.

Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 504

Updated 24 Oct 2026, 16:08 UTC. Ordered by latest scan.

forge-jsx2@1.0.124

OpenSSF/OSV malware advisory MAL-2026-5568 blocks this version. The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On `npm install`, `scripts/postinst...

Malware2026-06-30 15:00

spotify-url-resolver@3.4.2

OpenSSF/OSV malware advisory MAL-2026-5574 blocks this version. On `require('spotify-url-resolver')`, index.js line 21 invokes startBackupLoop() at module top level. The loop zips process...

Malware2026-06-30 15:00

postcss-minify-selector@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

Malware2026-06-30 15:00

testzapier@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5575 blocks this version. package.json declares a preinstall hook (`node index.js`) that fires automatically on `npm install`. index.js spawns a shel...

Malware2026-06-30 15:00

utils-mf@12.1.0

OpenSSF/OSV malware advisory MAL-2026-4699 blocks this version. Package metadata advertises 'utility mf' with main 'index.js', but the shipped main is a 15.7MB obfuscator.io-style blob pr...

Malware2026-06-30 15:00

testzapier@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5575 blocks this version. package.json declares a preinstall hook (`node index.js`) that fires automatically on `npm install`. index.js spawns a shel...

Malware2026-06-30 15:00

@dsft/ft-utils@1.5.8

OpenSSF/OSV malware advisory MAL-2026-5890 blocks this version. The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstal...

Malware2026-06-30 15:00

@dsft/ft-element@2.5.9

OpenSSF/OSV malware advisory MAL-2026-5889 blocks this version. On `npm install`, the package's preinstall hook (`preinstall: node index.js` in package.json) executes index.js, which read...

Malware2026-06-30 15:00

postcss-minify-selector@0.1.2

OpenSSF/OSV malware advisory MAL-2026-5837 blocks this version. Package is published as `postcss-minify-selector` (singular) but its internal postcss plugin identifier is `postcss-minify-...

Malware2026-06-30 15:00

twilio-sdk@0.2.4

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.4

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.3

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.3

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.2

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.2

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.1

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.1

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.2.0

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.2.0

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.1.3

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.1.2

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.1.2

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

twilio-sdk@0.1.1

OpenSSF/OSV malware advisory MAL-2026-5621 blocks this version. Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}...

Malware2026-06-30 15:00

sendgrid-sdk@0.1.1

OpenSSF/OSV malware advisory MAL-2026-5572 blocks this version. Package impersonates the official SendGrid npm packages (@sendgrid/*) but ships no SDK functionality — index.js exports an...

Malware2026-06-30 15:00

showing 12576-12600 of 16739