Malware in npm packages.
LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.
Packages — page 7
513 packages with LPM's own review, newest scan first. Showing 289–336.
This is concrete, hidden, remote-controlled unauthorized account mutation during normal package use. The absence of install hooks does not mitigate the runtime behavior.
The benign engine check does not explain the obfuscated runtime mutation. Concealed third-party branding injected into user messages is concrete, non-consensual payload manipulation.
Source directly shows a cashout flow that ignores supplied beneficiary configuration and targets a fixed account, which is concrete fund-diversion behavior. The install hook further mutat...