Malware in npm packages.

LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.

Packages — page 8

513 packages with LPM's own review, newest scan first. Showing 337–384.

Aug 13, 2026

eslint-generate-release@99.9.1

Malware

OpenSSF Malicious Packages via OSV confirms eslint-generate-release@99.9.1 as malicious (MAL-2026-13980): Malicious code in eslint-generate-release (npm)

Aug 13, 2026

eslint-publish-release@99.9.1

Malware

OpenSSF Malicious Packages via OSV confirms eslint-publish-release@99.9.1 as malicious (MAL-2026-13981): Malicious code in eslint-publish-release (npm)

Aug 13, 2026

in-install@99.9.1

Malware

OpenSSF Malicious Packages via OSV confirms in-install@99.9.1 as malicious (MAL-2026-13982): Malicious code in in-install (npm)

Aug 13, 2026

knip-bun@99.9.1