Crypto miner in npm packages.
These packages run cryptocurrency mining software on the machine that installs them.
Packages
5 packages with LPM's own review, newest scan first. Showing 1–5.
The postinstall hook establishes automatic activation, and the shell source shows remote payload execution and cryptocurrency mining behavior. This is malicious package behavior.
The postinstall hook performs concealed cryptocurrency mining and can run downloaded code with elevated privileges. This is concrete malicious install-time behavior.
The manifest automatically invokes a script that downloads and launches a concealed cryptocurrency miner, including an elevated execution path. This is concrete malicious install-hook beh...
The manifest connects postinstall directly to a helper that downloads and launches a concealed miner, with privileged and unprivileged execution paths. This is concrete malicious install-...
This is concrete, auto-starting cryptomining behavior in the published runtime entrypoint, not merely a suspicious primitive. The absence of install hooks does not mitigate runtime harm t...