Malware in npm packages.

LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.

Packages — page 4

513 packages with LPM's own review, newest scan first. Showing 145–192.

Sep 30, 2026

@bottino/baileys@1.0.14

Malware

OpenSSF Malicious Packages via OSV confirms @bottino/baileys@1.0.14 as malicious (MAL-2026-17351): Malicious code in @bottino/baileys (npm)

Sep 30, 2026

@ikyyjee/ikkysingle@0.1.2

Malware

OpenSSF Malicious Packages via OSV confirms @ikyyjee/ikkysingle@0.1.2 as malicious (MAL-2026-17356): Malicious code in @ikyyjee/ikkysingle (npm)

Sep 30, 2026

baileys-xbats@1.0.0

Malware

OpenSSF Malicious Packages via OSV confirms baileys-xbats@1.0.0 as malicious (MAL-2026-17388): Malicious code in baileys-xbats (npm)

Sep 30, 2026

focashi@1.1.0

Malware