npm threat types
Malware in npm packages.
LPM's review confirmed these package versions as malicious, and their behavior does not fit a narrower category. Some also appear in OpenSSF and OSV malicious-package advisories.
Packages — page 9
513 packages with LPM's own review, newest scan first. Showing 385–432.
Aug 7, 2026
vanexa-agent@1.1.48
MalwareOpenSSF Malicious Packages via OSV confirms vanexa-agent@1.1.48 as malicious (MAL-2026-10751): Malicious code in vanexa-agent (npm)
Aug 7, 2026
ynastore-baileys@1.0.21
MalwareOpenSSF Malicious Packages via OSV confirms ynastore-baileys@1.0.21 as malicious (MAL-2026-13470): Malicious code in ynastore-baileys (npm)
Aug 6, 2026
streak-map-cache@1.0.0
MalwareSource inspection confirms an import-time hidden executable with concrete backdoor, exfiltration, and persistence functionality. No install hook is needed because normal application impor...
Aug 6, 2026
streak-cache-map