Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-12 19:11Soft block: AI-agent control surface2026-09-12 19:01Soft block: AI-agent control surface2026-09-12 18:56Soft block: AI-agent control surface2026-09-12 18:45
npm threat feed
npm AI-agent policy reports, with evidence.
Review AI-agent capability abuse and control hijacking, including changes to agent configuration, instructions, or permissions. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 36
Updated 9 Oct 2026, 11:30 UTC. Ordered by latest scan.
@kingingwang/grok@1.0.24-b208f462
This is a counterfeit Grok package with an automatic lifecycle hook that deploys a publisher-controlled executable and alters foreign AI CLI state. The lack of direct JavaScript exfiltrat...
0xray@4.0.7
This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces, including a machine-wide executable pre-tool hook. The absence of observed secret exfiltration doe...
chron-mcp@0.1.56
The install-time hook silently makes broad global agent and shell changes, then injects mandatory conversation-logging instructions. This meets the policy for malicious install-hook abuse...
@agentprojectcontext/apx@1.107.0
The automatic postinstall mutation of global AI-agent skill directories is a concrete unconsented control-surface write. Remote-fetched content makes that install-time mutation more severe.