Malicious code in eslint-plugin-lwc (npm)

The package eslint-plugin-lwc was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

MAL-2026-10923 Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

Malware in lwc-slds-lbc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview lwc-slds-lbc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-19857 Malicious code in eslint-plugin-lwc (npm)

The package eslint-plugin-lwc was found to contain malicious code...

Malicious code in eslint-plugin-lwc (npm)

The package eslint-plugin-lwc was found to contain malicious code...

Malicious code in lwc-components-lightning (npm)

The package lwc-components-lightning was found to contain malicious code...

Malware in lwc-recipes

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-2605 Malicious code in lwc-recipes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92235263cd97e4d59a59394c77aeabcc20e347bda974b68b18072cf74295f12c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwc-recipes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92235263cd97e4d59a59394c77aeabcc20e347bda974b68b18072cf74295f12c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwc-monorepo (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2643 Malicious code in lwc-monorepo (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-75 Malicious code in lwc-jest-serializer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c88fb0df21e3f633176d1aa6411b5fa4bb5175518fe00ea39ededf35bf8823de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in lwc-jest-serializer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in lwc-jest-serializer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c88fb0df21e3f633176d1aa6411b5fa4bb5175518fe00ea39ededf35bf8823de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @sfdc-www/hgf-lwc-components is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious code in lwc-playground (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98e335481687ce6c9f293923692ec4f19da6a49f4d5fe8c014625761fe5a23cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4430 Malicious code in lwc-playground (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98e335481687ce6c9f293923692ec4f19da6a49f4d5fe8c014625761fe5a23cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in lwc-playground

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...