Malware in npm packages.
LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.
Packages — page 5
513 packages with LPM's own review, newest scan first. Showing 193–240.
OpenSSF Malicious Packages via OSV confirms chai-logger@3.0.2 as malicious (MAL-2026-16380): Malicious code in chai-logger (npm)
The package actively implements concealed, challenge-gated remote redirection in its only payload. Its opaque implementation and lack of legitimate package behavior support blocking it as...
The sole npm entrypoint is an obfuscated remote challenge-and-redirect page, not package functionality. Its concealed request and automatic redirect constitute concrete malicious behavior.