Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-12 21:55Install Hook Abuse2026-09-12 21:45Install Hook Abuse2026-09-12 21:42Install Hook Abuse2026-09-12 21:35
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 19
Updated 8 Oct 2026, 21:42 UTC. Ordered by latest scan.
your-ai-workflow-firebase-os@1.14.18
The package performs broad, automatic mutation of a consuming project and persists control over its entry files through an injected build plugin. Reviewer-directed prompt-injection langua...
termdock@1.4.192
The package performs unconsented privileged-capable system mutation from an automatic install hook and repeats it on ordinary execution. This is a concrete install-hook abuse path, not me...
@codyswann/lisa@4.55.17
This is an unconsented install-time mutation of broad consumer project and AI-agent control surfaces, with durable execution paths added to later installs and Git operations. The behavior...
claude-token-saver@3.31.0
This is concrete unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle hook persists package-controlled commands and instructions globally, meeting the insta...