Which versions of lovable-tager are malicious?

The following npm versions of lovable-tager are flagged malicious: 1.4.0, 1.4.1. Treat any of these as compromised.

How do I remediate lovable-tager if I installed it?

lovable-tager is a typosquat — you almost certainly intended a legitimately-named package. Remove lovable-tager, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed lovable-tager — how do I know if it already compromised me?

If lovable-tager was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is lovable-tager part of a known attack campaign?

Yes — lovable-tager is associated with the IN-MAL-2026-009365, IN-MAL-2026-009359 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find lovable-tager across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for lovable-tager (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging lovable-tager across your stack and pipelines.

Malicious package

lovable-tagernpm

Malicious code in lovable-tager (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-10088

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall lovable-tager

What this malware does

lovable-tager is a single-character-deletion typosquat of the legitimate Vite plugin lovable-tagger. The ESM entry dist/index.js (referenced by main) contains the clean plugin code followed by ~6 KB of tab padding and then an appended obfuscator.io-style permutation-obfuscated IIFE. On module load, the IIFE assigns global.require, global.__dirname, and global.__filename, derives Function via a deshuffled constructor lookup, constructs a new Function from an obfuscated string body, and immediately invokes it. The sibling CJS build dist/index.cjs, produced from the same source, contains only the clean plugin code with no such trailer — indicating the payload was smuggled into the published tarball after the normal build ran, hidden behind tab padding that suppresses it in most editors and diff views. Any project that adds the mistyped name to its Vite config executes attacker-controlled code inside the developer's Node process at plugin-load time, with the ability to reach require, the filesystem, and the network of the build host.

Malicious versions

2 flagged

1.4.01.4.1

Indicators of compromise (SHA-256)

0f100c9dbac6f2e352e559d0eb06f573e971845cc083b80c61f211013e03973a

cc8ab43092d5c820c05237645c102e332aa8c94fc1c4bc51795bc1ed7a4baa22

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for lovable-tager (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging lovable-tager across your stack and pipelines.
If you installed it — respond
lovable-tager is a typosquat — you almost certainly intended a legitimately-named package. Remove lovable-tager, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If lovable-tager was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks lovable-tager before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. lovable-tager on npm has been identified as a malicious package (versions 1.4.0, 1.4.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-009365IN-MAL-2026-009359

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks lovable-tager-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring