Malware in npm packages.
LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.
Packages — page 3
513 packages with LPM's own review, newest scan first. Showing 97–144.
OpenSSF Malicious Packages via OSV confirms @myorder-frontend-commons/analytics@0.0.0-stage as malicious (MAL-2026-17749): Malicious code in @myorder-frontend-commons/analytics (npm)
The published source contains reviewer-directed references to specific AI review policies and outcomes, matching the reviewer-manipulation policy. This supports blocking for malicious rev...
The obfuscated, remotely configured browser redirect flow is concrete deceptive behavior in the package entry page. This supports blocking the package as malware.