Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-13 23:52Install Hook Abuse2026-09-13 22:21Install Hook Abuse2026-09-13 22:16Install Hook Abuse2026-09-13 21:44
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 17
Updated 8 Oct 2026, 20:15 UTC. Ordered by latest scan.
@rayul/kordis@0.14.0
The complete lifecycle path automatically and silently modifies global instruction files for three unrelated AI-agent tools, then injects directives that influence future sessions. This i...
basinfy@1.1.0
The automatic postinstall hook mutates a foreign AI-agent control surface and installed dependencies, then can execute another install script with inherited environment variables. This is...
johns-harness@2026.9.20
The automatic postinstall hook performs broad dependency replacement and removes debugging artifacts. That is concrete install-hook abuse, regardless of the absence of a confirmed externa...
@firestitch/component-tools@18.0.18
This is a concrete install-hook abuse chain affecting the consumer's files and Git remote. The editor settings are benign-looking, but they do not justify destructive deletion, commit, an...