Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-04 03:07Malware2026-09-04 03:06Install Hook Abuse2026-09-04 03:05Install Hook Abuse2026-09-04 03:03
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 113
Updated 11 Oct 2026, 12:06 UTC. Ordered by latest scan.
@codyswann/lisa@4.34.7
The package performs automatic, broad consumer-project and AI-agent configuration changes during postinstall, then persists itself in the consumer's own lifecycle script. This meets the p...
comein-player-web@0.1.0
The UMD entrypoint is intentionally obfuscated and dynamically evaluates generated code. This is concrete opaque runtime execution in the package's normal import path.
aws-runtime-bridge@1.9.142
The package performs broad, privileged host mutation from automatic npm lifecycle hooks. This is concrete install-hook abuse, not a user-invoked setup action.
nginxforge-panel@1.1.6
The install-time hook performs broad host package installation rather than limiting itself to package-local setup. The behavior is activated automatically by npm installation and can invo...
