Skip to main content

Threat feed Threat types Research How it works Policy

Threat feed Threat types Research How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 623 | LPM Firewall

npm threat feed

npm advisory reports, with evidence.

Investigate malicious npm packages reported through OSV and public advisories. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 623

Updated 28 Oct 2026, 00:44 UTC. Ordered by latest scan.

@gusmano/reext@0.0.255

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.251

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.250

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.237

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.236

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.235

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.223

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.222

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.218

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.216

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.209

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.198

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.197

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.190

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.188

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.169

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.166

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.150

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.148

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.128

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.121

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@gusmano/reext@0.0.104

OpenSSF/OSV malware advisory MAL-2026-3684 blocks this version. The npm preinstall lifecycle script (dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/p...

Malware2026-06-30 15:00

@opensearch-project/opensearch@3.8.0

OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.

Malware2026-06-30 15:00

@opensearch-project/opensearch@3.7.0

OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.

Malware2026-06-30 15:00

@opensearch-project/opensearch@3.6.2

OpenSSF/OSV malware advisory MAL-2026-3434 blocks this version. The package @opensearch-project/opensearch was found to contain malicious code.

Malware2026-06-30 15:00

showing 15551-15575 of 16789