registry / Install hook abuse / @jait/gateway
@jait/gateway
Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control
This report shows the evidence for @jait/gateway@0.1.848. 5 of 210 known versions are blocked or flagged. The newest version, 0.1.959, is allowed. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package performs an unconsented external runtime installation during postinstall, creating a supply-chain execution path outside npm's declared dependency set. The pinned version and Jait-specific directory do not remove the automatic code-execution risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs the postinstall lifecycle hook.
Impact
Remote Python package installation can execute package-controlled code under the installing user's account.
Mechanism
Postinstall-driven Python virtual environment creation and pip package installation.
Attack narrative
The npm postinstall hook imports the Graphify runtime manager automatically. That manager creates a virtual environment beneath the user's Jait state directory and invokes pip to install graphifyy version 0.9.30. Pip installation executes externally obtained Python package code without a separate user command or integrity verification in this package.
AI rationale
The package performs an unconsented external runtime installation during postinstall, creating a supply-chain execution path outside npm's declared dependency set. The pinned version and Jait-specific directory do not remove the automatic code-execution risk.
Evidence
package.jsonbin/install-runtime.mjsdist/services/code-graph/graphify-runtime.jsdist/state-directory.js~/.jait/runtime/graphify/venv~/.jait/runtime/graphify/runtime.json
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs a postinstall hook automatically.
- The hook imports and runs the runtime provisioner during installation.
- The provisioner creates a Python virtual environment and uses pip to install the external graphifyy package.
- The runtime is stored under the user's home-based Jait state directory.
Evidence against
- The external Python package name and version are pinned.
- The files are placed in a Jait-specific state directory rather than the consumer project.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
web-dist/assets/index-BuL27KY9.js3.68 MB file, sampled 256 KB
NetworkWebSocketHighEntropyStringsMinifiedUrlStringsreact.devwww.w3.org
Source & flagged code
27 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/install-runtime.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgweb-dist/assets/index-wUWsnhHq.jsView file
141?|[
L142: \v\f
\u2028\u2029])`),r));else if(p==="posix")if(!o&&(c==="graph"||c==="print")){if(i==="strict")throw new Error(`POSIX class "${c}" requires min target ES2024 or non-strict accura...
L143: //# sourceMappingURL=index-wUWsnhHq.js.map
High
Child Process
Package source references child process execution.
web-dist/assets/index-wUWsnhHq.jsView on unpkg · L141bin/jait.mjsView file
742L743: const execArgs = [nodePath, jaitBin];
L744: if (existsSync(envFlag)) execArgs.push("--env", envFlag);
High
30Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network
L30: import { fileURLToPath } from "node:url";
L31: import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
L32: import { createConnection } from "node:net";
L33: import { createInterface } from "node:readline";
L34:
L35: const __dirname = dirname(fileURLToPath(import.meta.url));
L36: const pkg = JSON.parse(
L37: readFileSync(resolve(__dirname, "..", "package.json"), "utf8"),
L38: );
...
L118: } catch (err) {
L119: if (silent) return err.stdout || "";
L120: throw err;
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
bin/jait.mjsView on unpkg · L30•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = bin/jait.mjs
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/jait.mjsView on unpkgdist/tools/screenshot-tools.jsView file
59try {
L60: const loadPlaywright = new Function("return import('playwright')");
L61: const mod = (await loadPlaywright());
High
Eval
Package source references dynamic code evaluation.
dist/tools/screenshot-tools.jsView on unpkg · L59bin/install-runtime.mjsView file
20try {
L21: const { ensureGraphifyRuntime } = await import(runtimeModule);
L22: await ensureGraphifyRuntime({
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/install-runtime.mjsView on unpkg · L20dist/tools/redeploy-tools.jsView file
104log(`🐤 Starting canary on port ${canaryPort}...\n`);
L105: const canary = spawn("jait", ["--port", String(canaryPort)], {
L106: stdio: "ignore",
L107: detached: true,
L108: env: { ...process.env, PORT: String(canaryPort), __JAIT_CLI: "1" },
L109: windowsHide: true,
...
L111: canary.unref();
L112: const healthy = await waitForHealth(`http://127.0.0.1:${canaryPort}`, 30_000);
L113: if (!healthy) {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/tools/redeploy-tools.jsView on unpkg · L1046* **systemd** (detected when INVOCATION_ID is set):
L7: * 1. npm install -g @jait/gateway@latest
L8: * 2. Spawn canary on PORT+1, health-check it
...
L19: */
L20: import { execSync, spawn } from "node:child_process";
L21: export function createRedeployTool(deps) {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/tools/redeploy-tools.jsView on unpkg · L6dist/tools/browser-tools.jsView file
5const DEFAULT_BROWSER_ID = "browser-default";
L6: const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
L7: const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5";
...
L132: message: `Navigated to ${snapshot.url}`,
L133: data: buildSnapshotPayload(surface.id, snapshot, session),
L134: };
...
L363: const timeout = setTimeout(() => controller.abort(), timeoutMs);
L364: const ignoreTlsErrors = input.ignoreTlsErrors === true || process.env["WEB_FETCH_IGNORE_TLS_ERRORS"] === "true";
L365: try {
...
L371: }, ignoreTlsErrors);
L372: const text = await response.text();
L373: return {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/tools/browser-tools.jsView on unpkg · L55Trigger-reachable chain: scripts.start -> dist/index.js -> dist/tools/index.js -> dist/tools/browser-tools.js
L5: const DEFAULT_BROWSER_ID = "browser-default";
L6: const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
L7: const DEFAULT_OPENAI_WEB_SEARCH_MODEL = "gpt-5";
...
L132: message: `Navigated to ${snapshot.url}`,
L133: data: buildSnapshotPayload(surface.id, snapshot, session),
L134: };
...
L363: const timeout = setTimeout(() => controller.abort(), timeoutMs);
L364: const ignoreTlsErrors = input.ignoreTlsErrors === true || process.env["WEB_FETCH_IGNORE_TLS_ERRORS"] === "true";
L365: try {
...
L371: }, ignoreTlsErrors);
L372: const text = await response.text();
L373: return {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/tools/browser-tools.jsView on unpkg · L5dist/surfaces/browser.jsView file
398package = @jait/gateway; repositoryIdentity = jait; dependency = playwright
L398: // boot in environments that do not need browser automation.
L399: const loadPlaywright = new Function("return import('playwright')");
L400: let mod;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/surfaces/browser.jsView on unpkg · L398•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/surfaces/browser.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/surfaces/browser.jsView on unpkgdist/services/git-forge.jsView file
6Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/services/thread-review-sync.js -> dist/services/git-forge.js
L6: */
L7: import { exec as execCb } from "node:child_process";
L8: import { writeFile, unlink } from "node:fs/promises";
...
L13: return new Promise((resolve, reject) => {
L14: execCb(cmd, { encoding: "utf-8", windowsHide: true, ...opts }, (error, stdout, stderr) => {
L15: if (error) {
...
L27: function cleanGhEnv() {
L28: const { GH_REPO, GH_HOST, GH_TOKEN, GITHUB_TOKEN, ...rest } = process.env;
L29: return rest;
...
L101: proc.on("error", () => resolve(null));
L102: proc.stdin.write("protocol=https\nhost=github.com\n\n");
L103: proc.stdin.end();
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
dist/services/git-forge.jsView on unpkg · L6•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/services/git-forge.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/git-forge.jsView on unpkgweb-dist/noVNC/app/images/icons/MakefileView file
•path = web-[redacted]
kind = build_helper
sizeBytes = 1331
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
web-dist/noVNC/app/images/icons/MakefileView on unpkgweb-dist/noVNC/app/sounds/bell.ogaView file
•path = web-dist/noVNC/app/sounds/bell.oga
kind = high_entropy_blob
sizeBytes = 8495
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
web-dist/noVNC/app/sounds/bell.ogaView on unpkgdist/channels/manager.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 16
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/channels/manager.js#virtual:normalized:round1View on unpkgdist/surfaces/terminal.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/surfaces/terminal.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/surfaces/terminal.jsView on unpkgdist/clawhub/client.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/clawhub/client.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/clawhub/client.jsView on unpkgdist/routes/update.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/routes/update.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/routes/update.jsView on unpkgdist/security/sandbox-manager.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/security/sandbox-manager.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/security/sandbox-manager.jsView on unpkgdist/routes/project.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/routes/project.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/routes/project.jsView on unpkgdist/services/live-view-manager.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/services/live-view-manager.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/live-view-manager.jsView on unpkgdist/services/maintenance.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/services/maintenance.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/services/maintenance.jsView on unpkgdist/channels/msteams/connector.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = dist/channels/msteams/connector.js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/channels/msteams/connector.jsView on unpkgdist/channels/telegram/connector.jsView file
•matchType = normalized_sha256
matchedPackage = @jait/gateway@0.1.807
matchedPath = [redacted].js
matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/channels/telegram/connector.jsView on unpkgFindings
2 Critical23 High5 Medium4 Low
CriticalCredential Exfiltrationdist/tools/browser-tools.js
CriticalTrigger Reachable Dangerous Capabilitydist/tools/browser-tools.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processweb-dist/assets/index-wUWsnhHq.js
HighShellbin/jait.mjs
HighEvaldist/tools/screenshot-tools.js
HighEntrypoint Build Divergencebin/jait.mjs
HighSame File Env Network Executiondist/tools/redeploy-tools.js
HighCopied Package Dependency Bridgedist/surfaces/browser.js
HighTrigger Reachable Credential Exfiltrationdist/services/git-forge.js
HighRuntime Package Installdist/tools/redeploy-tools.js
HighShips High Entropy Blobweb-dist/noVNC/app/sounds/bell.oga
HighSemantic Analysis Limiteddist/channels/manager.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/surfaces/terminal.js
HighKnown Malware Source Similaritybin/jait.mjs
HighKnown Malware Source Similaritydist/clawhub/client.js
HighKnown Malware Source Similaritydist/routes/update.js
HighKnown Malware Source Similaritydist/security/sandbox-manager.js
HighKnown Malware Source Similaritydist/services/git-forge.js
HighKnown Malware Source Similaritydist/surfaces/browser.js
HighKnown Malware Source Similaritydist/routes/project.js
HighKnown Malware Source Similaritydist/services/live-view-manager.js
HighKnown Malware Source Similaritydist/services/maintenance.js
HighKnown Malware Source Similaritydist/channels/msteams/connector.js
HighKnown Malware Source Similaritydist/channels/telegram/connector.js
MediumDynamic Requirebin/install-runtime.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperweb-dist/noVNC/app/images/icons/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @jait/gateway@0.1.848.
The versions list below shows the verdict for each recorded version.
- Avoid installing @jait/gateway@0.1.848. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
210 known versions0.1.959latestManual Review—AllowUnder ReviewOct 22, 2026, 1:39 PM0.1.957Manual Review—AllowUnder ReviewOct 21, 2026, 8:55 AM0.1.956Suspicious—WarnPublishedOct 21, 2026, 6:36 AM0.1.955SuspiciousInstall Hook AbuseWarnPublishedOct 21, 2026, 12:18 AM0.1.949Manual Review—AllowUnder ReviewOct 19, 2026, 11:41 AM0.1.948Manual Review—AllowUnder ReviewOct 18, 2026, 6:37 PM0.1.947Manual Review—AllowUnder ReviewOct 18, 2026, 3:13 PM0.1.946Manual Review—AllowUnder ReviewOct 17, 2026, 9:38 PM0.1.945Manual Review—AllowUnder ReviewOct 17, 2026, 6:51 AM0.1.944Manual Review—AllowUnder ReviewOct 16, 2026, 10:54 PM0.1.943SuspiciousCredential ExfiltrationWarnPublishedOct 16, 2026, 8:35 PM0.1.942Manual Review—AllowUnder ReviewOct 16, 2026, 3:10 PM0.1.941SuspiciousInstall Hook AbuseWarnPublishedOct 16, 2026, 8:14 AM0.1.940Manual Review—AllowUnder ReviewOct 15, 2026, 9:55 PM0.1.939Manual Review—AllowUnder ReviewOct 15, 2026, 9:08 PM0.1.938Manual Review—AllowUnder ReviewOct 15, 2026, 8:25 PM0.1.937Manual Review—AllowUnder ReviewOct 15, 2026, 7:03 PM0.1.936Manual Review—AllowUnder ReviewOct 15, 2026, 10:51 AM0.1.935Manual Review—AllowUnder ReviewOct 13, 2026, 9:23 PM0.1.934Manual Review—AllowUnder ReviewOct 13, 2026, 8:11 PM0.1.933Manual Review—AllowUnder ReviewOct 13, 2026, 3:25 PM0.1.932Manual Review—AllowUnder ReviewOct 13, 2026, 1:01 PM0.1.931Manual Review—AllowUnder ReviewOct 12, 2026, 8:14 PM0.1.929SuspiciousAgent extension lifecycle riskWarnPublishedOct 12, 2026, 4:13 PM0.1.927Manual Review—AllowUnder ReviewOct 12, 2026, 1:58 PM0.1.926Manual Review—AllowUnder ReviewOct 12, 2026, 1:39 PM0.1.925Manual Review—AllowUnder ReviewOct 12, 2026, 1:00 PM0.1.924SuspiciousCredential ExfiltrationWarnPublishedOct 10, 2026, 10:44 PM0.1.923Manual Review—AllowUnder ReviewOct 10, 2026, 8:37 PM0.1.922Manual Review—AllowUnder ReviewOct 10, 2026, 4:48 PM0.1.921SuspiciousCredential ExfiltrationWarnPublishedOct 10, 2026, 11:43 AM0.1.920Manual Review—AllowUnder ReviewOct 9, 2026, 8:55 AM0.1.919SuspiciousAgent extension lifecycle riskWarnPublishedOct 8, 2026, 11:02 PM0.1.918SuspiciousCredential ExfiltrationWarnPublishedOct 8, 2026, 9:28 PM0.1.917Manual Review—AllowUnder ReviewOct 8, 2026, 8:59 PM0.1.916Manual Review—AllowUnder ReviewOct 8, 2026, 7:41 PM0.1.915SuspiciousCredential ExfiltrationWarnPublishedOct 8, 2026, 7:07 PM0.1.914Manual Review—AllowUnder ReviewOct 8, 2026, 2:12 PM0.1.911Manual Review—AllowUnder ReviewOct 8, 2026, 6:00 AM0.1.909SuspiciousCredential ExfiltrationWarnPublishedOct 6, 2026, 7:27 PM0.1.906Manual Review—AllowUnder ReviewOct 6, 2026, 1:35 PM0.1.905Manual Review—AllowUnder ReviewOct 6, 2026, 9:05 AM0.1.902SuspiciousInstall Hook AbuseWarnPublishedOct 4, 2026, 11:57 PM0.1.901SuspiciousAgent extension lifecycle riskWarnPublishedOct 4, 2026, 4:50 PM0.1.897SuspiciousInstall Hook AbuseWarnPublishedOct 2, 2026, 7:49 PM0.1.890SuspiciousAI-agent capability abuseWarnPublishedSep 29, 2026, 12:02 PM0.1.889Manual Review—AllowUnder ReviewSep 28, 2026, 10:27 AM0.1.888Manual Review—AllowUnder ReviewSep 28, 2026, 10:14 AM0.1.887SuspiciousCredential ExfiltrationWarnPublishedSep 28, 2026, 8:43 AM0.1.886SuspiciousInstall Hook AbuseWarnPublishedSep 28, 2026, 6:52 AM0.1.885Manual Review—AllowUnder ReviewSep 28, 2026, 6:31 AM0.1.883SuspiciousCredential ExfiltrationWarnPublishedSep 27, 2026, 11:52 AM0.1.881Manual Review—AllowUnder ReviewSep 26, 2026, 11:28 PM0.1.880SuspiciousCredential ExfiltrationWarnPublishedSep 26, 2026, 1:24 PM0.1.879Manual Review—AllowUnder ReviewSep 26, 2026, 12:14 PM0.1.876Manual Review—AllowUnder ReviewSep 24, 2026, 4:27 PM0.1.871SuspiciousAgent extension lifecycle riskWarnPublishedSep 23, 2026, 2:27 PM0.1.869SuspiciousAgent extension lifecycle riskWarnPublishedSep 22, 2026, 5:24 PM0.1.868SuspiciousCredential ExfiltrationWarnPublishedSep 22, 2026, 7:35 AM0.1.867Manual Review—AllowUnder ReviewSep 21, 2026, 3:38 PM0.1.866SuspiciousCredential ExfiltrationWarnPublishedSep 20, 2026, 3:07 PM0.1.865Manual Review—AllowUnder ReviewSep 19, 2026, 8:33 PM0.1.864SuspiciousCredential ExfiltrationWarnPublishedSep 18, 2026, 9:09 AM0.1.862SuspiciousCredential ExfiltrationWarnPublishedSep 17, 2026, 8:41 PM0.1.861SuspiciousAgent extension lifecycle riskWarnPublishedSep 16, 2026, 8:18 PM0.1.860SuspiciousCredential ExfiltrationWarnPublishedSep 16, 2026, 10:19 AM0.1.859SuspiciousCredential ExfiltrationWarnPublishedSep 16, 2026, 9:42 AM0.1.858SuspiciousCredential ExfiltrationWarnPublishedSep 16, 2026, 7:11 AM0.1.857Manual Review—AllowUnder ReviewSep 15, 2026, 4:19 PM0.1.853SuspiciousCredential ExfiltrationWarnPublishedSep 15, 2026, 8:48 AM0.1.851SuspiciousRemote Code ExecutionWarnPublishedSep 14, 2026, 11:51 AM0.1.850SuspiciousInstall Hook AbuseWarnPublishedSep 14, 2026, 11:18 AM0.1.849SuspiciousInstall Hook AbuseWarnPublishedSep 14, 2026, 9:42 AM0.1.848shownMaliciousInstall Hook AbuseBlockPublishedSep 14, 2026, 7:41 AM0.1.847SuspiciousInstall Hook AbuseWarnPublishedSep 14, 2026, 6:03 AM0.1.846SuspiciousInstall Hook AbuseWarnPublishedSep 13, 2026, 5:20 PM0.1.845SuspiciousInstall Hook AbuseWarnPublishedSep 12, 2026, 8:13 PM0.1.844SuspiciousInstall Hook AbuseWarnPublishedSep 12, 2026, 5:19 PM0.1.843SuspiciousInstall Hook AbuseWarnPublishedSep 12, 2026, 4:34 PM0.1.840SuspiciousInstall Hook AbuseWarnPublishedSep 11, 2026, 12:27 PM0.1.839SuspiciousAgent extension lifecycle riskWarnPublishedSep 11, 2026, 8:22 AM0.1.838SuspiciousInstall Hook AbuseWarnPublishedSep 10, 2026, 9:20 PM0.1.836SuspiciousInstall Hook AbuseWarnPublishedSep 10, 2026, 10:52 AM0.1.833Suspicious—WarnUnder ReviewSep 9, 2026, 12:47 PM0.1.832SuspiciousInstall Hook AbuseWarnPublishedSep 9, 2026, 10:53 AM0.1.831SuspiciousInstall Hook AbuseWarnPublishedSep 8, 2026, 6:25 PM0.1.830SuspiciousInstall Hook AbuseWarnPublishedSep 8, 2026, 4:25 PM0.1.829SuspiciousStaged Payload CarrierWarnPublishedSep 8, 2026, 6:59 AM0.1.827SuspiciousInstall Hook AbuseWarnPublishedSep 7, 2026, 9:02 PM0.1.826SuspiciousInstall Hook AbuseWarnPublishedSep 7, 2026, 8:46 PM0.1.825SuspiciousInstall Hook AbuseWarnPublishedSep 6, 2026, 7:39 PM0.1.822Scan Failed—AllowUnder ReviewSep 5, 2026, 11:13 AM0.1.820SuspiciousInstall Hook AbuseWarnPublishedSep 4, 2026, 8:27 PM0.1.815SuspiciousInstall Hook AbuseWarnPublishedSep 2, 2026, 4:23 PM0.1.808SuspiciousInstall Hook AbuseWarnPublishedSep 1, 2026, 7:05 PM0.1.807MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 2:45 PM0.1.806SuspiciousInstall Hook AbuseWarnPublishedSep 1, 2026, 12:15 PM0.1.805SuspiciousInstall Hook AbuseWarnPublishedSep 1, 2026, 10:46 AM0.1.804MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 8:06 AM0.1.802MaliciousInstall Hook AbuseBlockPublishedAug 31, 2026, 3:03 PM
Showing the 100 most recent of 210 known versions.