Research

767 npm packages at version 99 and above: what dependency confusion probes collect

767 npm packages were published at version 99, 999 or similar so they outrank a private package with the same name. Most of them report where they were installed. Some take a lot more.

Published LPM Firewall research

Summary

  • 767 packages and 1,109 versions at major version 99, 100, 999, 1000, 9999 or 99999. Most of those with a known date appeared from April 2026 onwards.
  • 435 run code during npm install through a lifecycle script.
  • 337 collect the host name, user name or IP address, and 158 collect environment variables, often filtered for names like token, secret or password.
  • 218 send what they collect to a public callback service built for security testing.
  • 90 describe themselves as research, a proof of concept or a bug bounty submission.
  • LPM's own review confirms 150 as malicious, and 745 have an OpenSSF/OSV malicious-package advisory.

How dependency confusion works

Many companies keep internal packages in a private registry. If a build can also reach the public npm registry, and an internal name is not reserved there, anyone can publish a public package with that name. A very high version number makes the package manager prefer the public copy over the private one.

Unscoped internal names are most at risk. A scoped name such as @company/ui is only at risk when the scope is not mapped to the private registry. 279 of the packages here are scoped and 488 are not.

What the probes collect

A typical probe is a single package.json with a preinstall or postinstall script and a few lines of JavaScript or shell. When it runs, it sends a small beacon that identifies the machine. From the evidence for each package:

  • Host identity, such as the host name, user name, working directory and IP address: 337.
  • Environment variables, often filtered for secrets: 158.
  • Local configuration or credential files such as ~/.npmrc, ~/.aws/credentials, ~/.git-credentials or ~/.ssh: 27.
  • Data sent through DNS lookups, which gets past many HTTP egress filters: 73.
  • A reverse shell or remote command channel: 14.

A few are capture-the-flag exercises that search for /flag files (9). They behave the same way on a real machine.

Where the data goes

Most probes use services built for out-of-band security testing, which log any request sent to them:

  • Burp Collaborator (oastify.com, burpcollaborator.net): 64
  • Interactsh (oast.fun, oast.me, oast.site and others): 81
  • webhook.site: 71
  • Pipedream: 23
  • Discord or Telegram webhooks: 25

Anyone can create an endpoint on these services, so the domain alone does not identify the publisher, and blocking it outright can break legitimate testing. In CI, an outbound request to one of them during npm install is a strong signal.

Probe or attack?

Many of these packages come from researchers looking for dependency confusion bugs to report through bug bounty programs, and 90 say so. The intent does not change what happens on the machine that installs one: code runs without consent, and the data, often including environment variables that hold secrets, goes to a third party. Others use the same technique to deliver real payloads, like the August 2026 dependency confusion campaign. LPM Firewall blocks both.

More every month

First-publish dates are known for 509 of the packages. 17 appeared before March 2026. Since then, new probes per month:

  • March 2026 6
  • April 2026 27
  • May 2026 55
  • June 2026 66
  • July 2026 106
  • August 2026 90
  • September 2026 65
  • October 2026 77

What to do

  • Publish internal packages under an npm scope you own, and map that scope to your private registry in .npmrc.
  • Claim your organization's scope on npm, even if you never publish to it.
  • Do not let a private registry proxy fall back to the public registry for internal names, and install from lockfiles with integrity hashes.
  • Most probes run at install time, so npm install --ignore-scripts in CI stops them. It does not stop packages that run on import.
  • If one of these versions was installed, rotate the secrets that machine's environment held, and check the lockfile for how it got there.

Affected packages

767 packages. Each name links to its LPM Firewall report and is marked LPM confirmed or advisory.

scoped 279
unscoped 488

How we identified the packages

The list covers every npm package LPM Firewall blocks with a version at major 99, 100, 999, 1000, 9999 or 99999, as of Oct 23, 2026. The packages share a technique, not a publisher. The counts of each behavior come from LPM's reviews and the advisory text for each package, so they are lower bounds.

Read how LPM Firewall reports are produced, or browse more research.