Staged payload carrier in npm packages.

These packages ship an encoded or encrypted payload meant to be decoded and run by a later stage.

Packages

24 packages with LPM's own review, newest scan first. Showing 1–24.

Aug 28, 2026

@lucideproxy/svg@0.0.65

The automatic SVG import, deliberate obfuscation, and dynamic code execution are incompatible with a passive SVG package. Lack of install hooks reduces install-time risk but does not remo...

Aug 24, 2026

mobiwaefhxc3@1.0.0

Staged payload carrier

The package contains a concrete concealed remote redirect chain behind a security-verification facade. It is not install-time malware, but its runtime behavior is malicious.

Aug 24, 2026

mbxcnsuwgs1@1.0.0

Staged payload carrier

The package contains no npm lifecycle hook, but its sole shipped entry is an intentionally obfuscated server-directed redirector behind a fake verification UI. The concealed remote destin...

Aug 20, 2026

randompkga