npm threat types
Dependency script approval abuse in npm packages.
Install-lifecycle code in these packages expands a project's dependency script approvals without explicit informed approval. LPM blocks this by default even when malicious intent is unproven.
Packages
2 packages with LPM's own review, newest scan first. Showing 1–2.
Oct 22, 2026
pi-usereq@0.92.0
Dependency script approval abuseSource confirms an automatic postinstall mutation that grants consumer install-script approvals to unrelated dependencies without affirmative consent. This meets the block criteria for de...
Oct 14, 2026
esoftplay@0.0.269-beta7339f70
Dependency script approval abuseThe manifest automatically invokes the install branch, which expands and writes the consumer's install-script approval list. This meets the policy for blocking unconsented lifecycle expan...
Each card opens the package page with its evidence and every recorded version.