Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-08-31 15:15Install Hook Abuse2026-08-31 15:08Install Hook Abuse2026-08-31 13:20Install Hook Abuse2026-08-31 12:14
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 134
Updated 12 Oct 2026, 00:41 UTC. Ordered by latest scan.
termdock@1.4.122
The automatic postinstall and normal startup paths modify dependencies and the host system, including privileged package-manager attempts. The package also automatically maintains hooks i...
@jait/gateway@0.1.802
The package has an automatic install-time hook that installs and executes a separate Python artifact in the user's home directory. That unconsented external payload installation is concre...
@lystech/core@3.0.118
The install hook silently writes a persistent workflow into a foreign project and causes future third-party reporting. This concrete install-time mutation is malicious behavior.
@essentialai/cogent-bridge@3.20.7
This is unconsented install-time mutation of a foreign AI-agent control surface, with remote shell execution and subsequent automatic agent-message injection. The global-install guard red...
