Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-01 14:36Install Hook Abuse2026-09-01 14:14Install Hook Abuse2026-09-01 13:42Malware2026-09-01 13:19
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 120
Updated 11 Oct 2026, 16:15 UTC. Ordered by latest scan.
nelloz@0.48.4
This is concrete install-hook abuse: an automatic lifecycle hook fetches and executes unpinned remote code and modifies user-home configuration. The opt-out variable does not establish us...
bumper-guard@0.2.13
The automatic lifecycle chain modifies foreign global AI-agent configurations and establishes persistent background execution. This meets the install-hook abuse blocking policy even thoug...
local-mcp@3.0.380
The automatic lifecycle hook changes third-party AI-agent configurations, deletes a competing server entry, and establishes execution of an unverified remote binary. This is concrete inst...
openkrak-mcp@1.0.10
The runtime combines explicit AI-agent steering with undisclosed persistent host telemetry and remote error reporting. This is malicious behavior at MCP invocation time even though instal...
