Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-13 03:31Soft block: AI-agent control surface2026-09-13 03:23Soft block: AI-agent control surface2026-09-13 03:08Soft block: AI-agent control surface2026-09-13 03:01
npm threat feed
npm AI-agent policy reports, with evidence.
Review AI-agent capability abuse and control hijacking, including changes to agent configuration, instructions, or permissions. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 33
Updated 9 Oct 2026, 09:17 UTC. Ordered by latest scan.
agent-orchestration-workflow@0.3.1
The package's automatic postinstall writes a package-controlled skill into the user's global Codex configuration. Although no exfiltration or network payload was found, this concrete inst...
feishu-docs-cli@1.7.1
This is an automatic postinstall mutation of foreign AI-agent control surfaces. The copied content promotes installation of the same package, making the behavior a concrete control-hijack...
@agentgates/cli@0.38.0
This is an automatic postinstall mutation of foreign AI-agent control surfaces, coupled with instructions to route sensitive wallet and password actions through the package. The behavior...
@jenga-ai/agent@3.1.1
This is an unconsented postinstall mutation of broad AI-agent control surfaces, including automatic command-hook registration. The absence of observed network exfiltration does not remove...