Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-08 01:46Install Hook Abuse2026-09-08 01:39Install Hook Abuse2026-09-08 01:32Install Hook Abuse2026-09-08 01:31
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 26
Updated 9 Oct 2026, 03:05 UTC. Ordered by latest scan.
termdock@1.4.175
The package performs unconsented system package installation during postinstall and normal startup, then automatically globally reinstalls itself from npm. These are concrete install-hook...
open-item-validator@1.0.0
This is an unconsented install-time remote code execution chain. The signature check does not mitigate the package author's ability to deliver arbitrary code after publication.
@onescience/onecode@1.14.50-202609080918
This is a concrete install-hook payload delivery chain: an opaque native executable is automatically downloaded from a fixed host with TLS verification disabled, extracted, and enabled fo...
@cubic-dev-ai/cli@1.10.7
The package performs unconsented remote script execution and external tool configuration from a postinstall hook. This is concrete install-hook abuse, even though the snapshot contains no...