Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-20 08:43Install Hook Abuse2026-09-20 08:38Install Hook Abuse2026-09-20 08:31Install Hook Abuse2026-09-20 08:28
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 10
Updated 8 Oct 2026, 15:20 UTC. Ordered by latest scan.
@softize/opus@11.1.0
This is concrete install-hook abuse: an npm postinstall reaches package code that writes AI-agent configuration and execution hooks into the consumer repository. The absence of observed n...
@apexacc/cli@1.6.1
The active command contains explicit hidden elevation, antivirus exclusion, security-policy disablement, remote binary download, and execution. These actions are unrelated to normal CLI i...
@ainative/cody-cli@0.12.74
The automatic lifecycle hook performs destructive credential/configuration changes and account provisioning outside an explicit user command. This is concrete install-hook abuse, not ordi...
termdock@1.4.66
The automatic postinstall and startup paths execute privileged system mutations and unpinned tooling without an explicit user command. The behavior is concrete install-hook abuse, not mer...