Malware in npm packages.
LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.
Packages — page 10
513 packages with LPM's own review, newest scan first. Showing 433–480.
Source inspection confirms a postinstall side effect that collects local metadata and writes it outside the package, aligned with the package's dependency-confusion PoC description. Absen...
Direct inspection confirms an automatic postinstall collector and file write; the benign runtime entrypoint does not mitigate that install-time behavior. No network transmission was found.
Source inspection confirms the lifecycle payload and its local metadata collection/write behavior. The benign runtime entrypoint does not mitigate the install-time action.