Loading npm security reports…
Skip to main contentCredential Exfiltration2026-08-04 11:20Credential Exfiltration2026-08-04 11:20Credential Exfiltration2026-08-04 11:20
npm threat feed
npm credential and data exfiltration reports.
Investigate credential theft and data exfiltration, including attempts to send secrets or other sensitive data to an outside recipient. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 53
Updated 10 Oct 2026, 00:19 UTC. Ordered by latest scan.
@ornikar/monorepo-config@14.3.8
The install hook provides a concrete, unconsented execution chain into an obfuscated credential-focused payload with remote eval. This is malicious behavior, not package-aligned configura...
@ornikar/jest-config-react-native-web@12.0.8
Concrete source behavior establishes malicious install-time staged execution and credential-focused payload logic. The advertised entrypoint provides no functional configuration and inste...
@ornikar/babel-preset-kitt-universal@8.0.7
The documented preset is benign, but its install-time loader and opaque payload establish concrete malicious behavior. The Bun download is a bootstrap mechanism for executing the bundled...
@ornikar/intl-config@10.0.7
The unconsented preinstall execution chain delivers and runs an obfuscated credential-collection payload. This is concrete malicious behavior, not a package-aligned setup step.