Skip to main content

Threat feed Threat types Research How it works Policy

Threat feed Threat types Research How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

npm security reports and threat intelligence — page 650 | LPM Firewall

npm threat feed

npm security reports, with evidence.

Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.

Source

All sources Public advisories LPM Firewall detections

Category

All categories Malware Credential / data exfiltration Remote execution AI-agent control-surface policy Dependency confusion Dependency script approvals Persistence / destructive behavior

Security reports — page 650

Updated 27 Oct 2026, 11:59 UTC. Ordered by latest scan.

@thone33/core-utils@1.0.4

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

Malware2026-07-27 11:05

@thone33/core-utils@1.0.3

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

Malware2026-07-27 11:05

@thone33/core-utils@1.0.2

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

Malware2026-07-27 11:05

@thone33/core-utils@1.0.1

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

Malware2026-07-27 11:05

@thone33/analytics-injector@1.0.1

OpenSSF/OSV malware advisory MAL-2026-6563 blocks this version. Package presents itself as an 'analytics injection helper' with a no-op track() export, but its exported activate() functio...

Malware2026-07-27 11:05

@thone33/core-utils@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...

Malware2026-07-27 11:05

@thone33/analytics-injector@1.0.0

OpenSSF/OSV malware advisory MAL-2026-6563 blocks this version. Package presents itself as an 'analytics injection helper' with a no-op track() export, but its exported activate() functio...

Malware2026-07-27 11:05

v018-axios-cdntest@1.0.3

OpenSSF/OSV malware advisory MAL-2026-5529 blocks this version. Package impersonates axios v0.18.0 (index.js carries the genuine `axios v0.18.0 | (c) 2018 by Matt Zabriskie` header and se...

Malware2026-07-27 11:05

v018-axios-cdntest@1.0.2

OpenSSF/OSV malware advisory MAL-2026-5529 blocks this version. Package impersonates axios v0.18.0 (index.js carries the genuine `axios v0.18.0 | (c) 2018 by Matt Zabriskie` header and se...

Malware2026-07-27 11:05

v018-axios-cdntest@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5529 blocks this version. Package impersonates axios v0.18.0 (index.js carries the genuine `axios v0.18.0 | (c) 2018 by Matt Zabriskie` header and se...

Malware2026-07-27 11:05

v018-axios-cdntest@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5529 blocks this version. Package impersonates axios v0.18.0 (index.js carries the genuine `axios v0.18.0 | (c) 2018 by Matt Zabriskie` header and se...

Malware2026-07-27 11:05

express-timer@1.0.6

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

Malware2026-07-27 11:05

express-timer@1.0.5

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

Malware2026-07-27 11:05

express-timer@1.0.4

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

Malware2026-07-27 11:05

express-timer@1.0.3

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

Malware2026-07-27 11:05

express-timer@1.0.2

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

Malware2026-07-27 11:05

express-timer@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5555 blocks this version. express-timer is a destructive supply-chain attack masquerading as an Express security-headers helper. Three independent ha...

Malware2026-07-27 11:05

@403name/electron-buidler@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5547 blocks this version. On require(), index.js executes an immediately-invoked function that platform-gates to macOS, skips CI environments, drops...

Malware2026-07-27 11:05

@403name/fsevent@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5549 blocks this version. On require(), index.js runs an IIFE that gates to macOS, skips when CI or GITHUB_ACTIONS is set, waits 30-90 seconds, and w...

Malware2026-07-27 11:05

@403name/ether-js@1.0.1

OpenSSF/OSV malware advisory MAL-2026-5548 blocks this version. On require('@403name/ether-js'), index.js runs an IIFE that targets macOS only (returns early on non-darwin and when CI/GIT...

Malware2026-07-27 11:05

@403name/electron-buidler@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5547 blocks this version. On require(), index.js executes an immediately-invoked function that platform-gates to macOS, skips CI environments, drops...

Malware2026-07-27 11:05

@403name/fsevent@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5549 blocks this version. On require(), index.js runs an IIFE that gates to macOS, skips when CI or GITHUB_ACTIONS is set, waits 30-90 seconds, and w...

Malware2026-07-27 11:05

@403name/ether-js@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5548 blocks this version. On require('@403name/ether-js'), index.js runs an IIFE that targets macOS only (returns early on non-darwin and when CI/GIT...

Malware2026-07-27 11:05

express-self-destruct2@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5554 blocks this version. On install, the package's postinstall hook (scripts/inject.js) locates the installer's project root and main entry (from pa...

Malware2026-07-27 11:05

express-self-destruct@1.0.0

OpenSSF/OSV malware advisory MAL-2026-5553 blocks this version. On `npm install`, the package's `postinstall` hook (`node scripts/inject.js`) walks up from the install directory to locate...

Malware2026-07-27 11:05

showing 16226-16250 of 25463