Loading npm security reports…
Skip to main contentMalware2026-09-07 09:32Install Hook Abuse2026-09-07 09:16Install Hook Abuse2026-09-07 09:10Install Hook Abuse2026-09-07 09:04
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 102
Updated 11 Oct 2026, 05:50 UTC. Ordered by latest scan.
plogme@1.0.3
This is concrete, unconsented use of an authenticated third-party account combined with concealed targeting and host telemetry. The install hook itself is limited, but the runtime behavio...
best-radar-pulse@1.0.3
This package contains a silent, automatic install-time telemetry beacon that inspects consumer project metadata and transmits it to a third party without an explicit user command. The ven...
@agentgates/cli@0.20.0
The package has a concrete automatic postinstall persistence mechanism that mutates broad, foreign AI-agent control surfaces. Its injected instructions steer agents toward wallet and pass...
yu-method@1.1.4
The automatic lifecycle hook makes broad, persistent changes to foreign AI-agent control surfaces and installs an additional global package. This meets the install-hook abuse boundary reg...