Loading npm security reports…
Skip to main contentData Exfiltrationyesterday 08:03Data Exfiltrationyesterday 05:38Data Exfiltrationyesterday 05:05Data Exfiltration
npm threat feed
npm credential and data exfiltration reports.
Investigate credential theft and data exfiltration, including attempts to send secrets or other sensitive data to an outside recipient. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Latest security reports
Updated 8 Oct 2026, 08:48 UTC. Ordered by latest scan.
wix-ssr-thunderbolt-grid-polyfill@0.1.0
The manifest activates bundles that collect host and local service information and send data to a fixed external receiver. This is active data exfiltration, so the package is malicious.
toga-ai@1.0.966
The postinstall automatically modifies user-level Claude settings to enable forwarding session content to an external collector. This is an unconsented install-time data exfiltration path...
browser-metrics-plugin.contrib@99.0.1
The postinstall hook activates an outbound beacon that transmits machine identity and project path metadata to an unrelated hard-coded endpoint. This is active, unsolicited data exfiltrat...
troubleshooting@99.0.1
The package automatically transmits host and project location metadata to an unrelated external endpoint during installation and import. This is concrete data exfiltration, so the package...