Dependency confusion in npm packages.
These packages use the identity of another package, often an internal one, so that a build installs them in its place.
Packages
9 packages with LPM's own review, newest scan first. Showing 1–9.
The package performs unsolicited external callbacks during installation through a postinstall hook. This is concrete dependency-confusion install tracking and warrants blocking.
The package performs concealed, unconsented modification of a foreign project manifest during postinstall. No network or credential theft was found, but dependency injection alone is conc...
This is confirmed unconsented install-time metadata collection and file creation in a package explicitly positioned as a dependency-confusion PoC. Absence of network exfiltration does not...
The package has an unconsented postinstall that collects system/user data and mutates the filesystem, explicitly presented as dependency-confusion proof behavior. No exfiltration endpoint...
The lifecycle script silently hijacks another package's namespace, and runtime code performs undisclosed remote-controlled activity through user credentials. These are concrete malicious...
Despite benign/authorized claims, the source implements unconsented install-time reconnaissance and outbound exfiltration as a dependency-confusion proof of execution. That is concrete at...
Source inspection confirms unconsented install-time external beaconing from lifecycle scripts, which is concrete dependency-confusion behavior even if framed as authorized research. Lack...
Direct source inspection confirms unconsented install-time network beaconing in a dependency-confusion package, even though it does not harvest credentials or execute shell commands. The...
Source inspection confirms a lifecycle-triggered dependency-confusion PoC with external install pingback and persistent identifier, which is concrete unconsented behavior even though it d...