npm supply-chain research.
Investigations of npm malware campaigns found by LPM Firewall, with indicators of compromise, affected packages and remediation steps.
885 npm packages, one import-time loader: an August 2026 dependency confusion campaign
In August 2026, 885 npm packages copied internal-looking package names and ran a hidden binary loader on import. Indicators of compromise, affected packages and remediation.
767 npm packages at version 99 and above: what dependency confusion probes collect
767 npm packages published at version 99 or higher to win dependency confusion. What they collect at install time, where they send it, and how to keep internal package names safe.
105 Baileys forks on npm that quietly make WhatsApp accounts follow channels
105 forks of the Baileys WhatsApp library on npm use the developer's own WhatsApp session to follow channels picked by a remote list. How it works, indicators and affected packages.
96 fake chai plugins on npm that fetch and run remote code
96 npm packages imitate chai and its plugins, then start a hidden Node process that fetches JavaScript from paste services and runs it. Indicators and affected packages.