npm malware and threat types.

These packages run code that is not in the published tarball. Install or runtime code fetches JavaScript, shell commands or a payload from a remote endpoint and executes it, without a package-aligned reason the user controls.

These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.

LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.

These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.

These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.

These packages use npm lifecycle scripts (preinstall, install, postinstall) to run code automatically during npm install, for purposes the package does not need, such as collecting host details or changing global tooling.

These packages make lasting changes so code keeps running after installation, such as hidden startup hooks, VCS hooks or long-lived background processes outside normal package behavior.

These packages delete or overwrite files, damage repositories or otherwise disrupt the system they run on.

These packages ship an encoded or encrypted payload meant to be decoded and run by a later stage.

These packages change their behavior to make a political or social statement, for example by printing messages, sabotaging output or damaging files on selected systems.

These packages use the identity of another package, often an internal one, so that a build installs them in its place.

These packages run cryptocurrency mining software on the machine that installs them.

These packages misuse capabilities that AI coding agents grant them, for example by steering an agent to run commands, read secrets or change files outside the task.

Install-lifecycle code in these packages expands a project's dependency script approvals without explicit informed approval. LPM blocks this by default even when malicious intent is unproven.