Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-15 06:16Malware2026-09-15 05:19Install Hook Abuse2026-09-15 03:56Install Hook Abuse2026-09-15 03:51
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 14
Updated 8 Oct 2026, 18:16 UTC. Ordered by latest scan.
@toothfairyai/tfcode@2.5.3
The lifecycle hook performs unverified remote payload retrieval and broad user-environment package installation automatically. These actions create a concrete install-time code-execution...
@sigmashake/ssg@1.1.8
The automatic install hook deletes external user binaries and performs persistent machine tracking with remote transmission. This is concrete destructive behavior and data exfiltration un...
termdock@1.4.222
The package performs unconsented privileged operating-system package installation from postinstall and retries it on CLI startup. This is a concrete host-mutation attack surface despite n...
grepmax@0.26.26
This is an automatic install-hook supply-chain mutation that imports an unverified external native payload into a consumer dependency. The explicit plugin commands do not mitigate the sep...
