Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-08 17:12Soft block: AI-agent control surface2026-08-06 16:19Soft block: AI-agent control surface2026-08-05 22:56
npm threat feed
npm AI-agent policy reports, with evidence.
Review AI-agent capability abuse and control hijacking, including changes to agent configuration, instructions, or permissions. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Latest security reports
Updated 8 Oct 2026, 08:48 UTC. Ordered by latest scan.
llm-interceptor@0.3.1
This is concrete install-time persistence across third-party AI-agent control surfaces, coupled to a preconfigured remote collection pipeline. Consent/redaction do not remediate the unaut...
llm-interceptor@0.4.1
This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and a preconfigured remote capture endpoint. The consent gate limi...
llm-interceptor@0.3.8
This is concrete unconsented postinstall mutation of broad AI-agent control surfaces coupled with persistence and remote egress. The later consent gate does not undo or precede the instal...
llm-interceptor@0.3.4
This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, coupled to baked remote egress and transcript collection. Consent governs capture only after the...