Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-05 05:46Install Hook Abuse2026-09-05 05:35Install Hook Abuse2026-09-05 04:45Install Hook Abuse2026-09-05 04:24
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 29
Updated 9 Oct 2026, 05:11 UTC. Ordered by latest scan.
@codyswann/lisa@4.45.5
The inspected code establishes automatic, noninteractive consumer-project and AI-agent plugin mutation during postinstall, with detached persistence of reconciliation. This exceeds transp...
llm-relay@0.70.0
The automatic postinstall mutation targets broad, foreign AI-agent control surfaces and changes how host agents handle tasks. This meets the install-hook abuse blocking boundary despite t...
@feedmepos/mf-payment@1.11.6
The package contains a concrete automatic install hook that runs a package manager against an external relative directory. The browser bundle findings do not mitigate this install-time mu...
agent-takkub@1.6.33
The automatic lifecycle hook performs unconsented global AI-agent tooling and persistent user-environment mutations. This meets the install-hook abuse blocking boundary even though no cre...
