Malware in npm packages.

LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.

Packages

511 packages with LPM's own review, newest scan first. Showing 1–48.

Oct 22, 2026

@factiii/runner@0.28.0

Malware

OpenSSF Malicious Packages via OSV confirms @factiii/runner@0.28.0 as malicious (MAL-2026-18204): Malicious code in @factiii/runner (npm)

Oct 22, 2026

dsh-win32@0.17.15

Malware

Setup performs an account change to a publisher-selected repository without recipient-specific consent. This supports blocking based on the verified unrequested account action, even thoug...

Oct 22, 2026

agentic-awesome-skills@19.13.0

Malware

OpenSSF Malicious Packages via OSV confirms agentic-awesome-skills@19.13.0 as malicious (MAL-2026-18192): Malicious code in agentic-awesome-skills (npm)

Oct 22, 2026

darknode-cli