npm threat feed

npm credential and data exfiltration reports.

Investigate credential theft and data exfiltration, including attempts to send secrets or other sensitive data to an outside recipient. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.

Security reports — page 64

Updated 10 Oct 2026, 08:43 UTC. Ordered by latest scan.

node-fsagent@5.0.1783978336091

Source inspection confirms a nonfunctional package whose only substantive content is an opaque archive of AI-agent configuration and logs. This is a concrete sensitive-data distribution p...

Data Exfiltration2026-07-14 07:21

monitoring-service-util@1.0.0

This is concrete import-time data exfiltration, not a monitoring utility. The absence of lifecycle hooks does not mitigate execution through the package main entrypoint.

Data Exfiltration2026-07-14 07:19

monitoring-service-util@1.1.0

This is concrete import-time data theft and public npm exfiltration, not a benign dynamic-code pattern. The absence of lifecycle hooks does not mitigate the malicious main-entry behavior.

Data Exfiltration2026-07-14 07:19

test_adminet@99.9.9

Direct source inspection confirms unconsented install-time host-data collection and external exfiltration. This is concrete malicious behavior, not a benign package capability.

Data Exfiltration2026-07-13 21:44