Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-01 00:05Install Hook Abuse2026-08-31 23:41Install Hook Abuse2026-08-31 23:15Install Hook Abuse2026-08-31 23:06
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 129
Updated 11 Oct 2026, 21:42 UTC. Ordered by latest scan.
@ornexus/neocortex@4.60.32
This is an unconsented postinstall mutation of a broad AI-agent control surface, with deletion and external MCP registration. The automatic global-install path is concrete in the publishe...
pi-harness-runtime@1.1.33
The package has a concrete automatic lifecycle chain that modifies a foreign global agent configuration and installs a persistent startup plugin. Source inspection found no need for remot...
grix-connector@4.6.3
The package performs concrete, unconsented persistence and broad AI-agent control-surface changes, then provides an automatic self-update path to another lifecycle-enabled release. These...
@codyswann/lisa@4.27.4
The lifecycle path performs broad, automatic project-level AI-agent configuration and establishes later hook execution. The absence of observed secret theft does not remove this concrete...
