lil-swisgom-hlepers@49.9.9
Vulnerability report · Last retrieved from osv.dev September 6, 2026 at 4:01 AM UTC
OSV ID
MAL-2026-15689
Ecosystem
npm
Summary
package.json declares a dependency lil-swisgom-hlepers-core whose version specifier is a direct tarball URL on a third-party host (https://registry.grivy-packages.com/lil-swisgom-hlepers-core/-/lil-swisgom-hlepers-core-49.9.9.tgz) rather than a version resolved from the npm registry. On npm install, npm downloads and installs the arbitrary tarball from that host into the installer's dependency tree, bypassing npm registry review and scanning; any code the tarball ships (including install lifecycle scripts and module-load side effects) then runs on the installer's machine. The package name itself is a misspelling (hlepers for helpers), consistent with a typosquat lure funneling installers into pulling attacker-hosted tarball content.
Source: amazon-inspector (75aeaaa8ef6f56423bf517d9ff21cfed3a682701f306103f068b948e330f03db)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.