Malware in npm packages.
LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.
Packages — page 11
513 packages with LPM's own review, newest scan first. Showing 481–513.
OpenSSF Malicious Packages via OSV confirms ishowfeet13@2.0.0 as malicious (MAL-2026-10315): Malicious code in ishowfeet13 (npm)
OpenSSF Malicious Packages via OSV confirms ishowfeet20@2.0.0 as malicious (MAL-2026-10323): Malicious code in ishowfeet20 (npm)
OpenSSF Malicious Packages via OSV confirms nottuff7@2.0.0 as malicious (MAL-2026-5918): Malicious code in nottuff7 (npm)
OpenSSF Malicious Packages via OSV confirms ishowfeet16@2.0.0 as malicious (MAL-2026-10318): Malicious code in ishowfeet16 (npm)