Over 800 npm Packages Found with Discrepancies, 18 Exploitable to 'Manifest Confusion'

JFrog researchers identified over 800 npm packages with mismatches between the registry manifest and the package.json inside the tarball; 18 appear crafted to exploit a technique called "manifest confusion" that can hide malicious dependencies during installation, though most findings are proofs-of-concept and no active campaigns were observed—developers are advised to validate package contents and check for hidden dependencies.