Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-01 18:42Install Hook Abuse2026-09-01 17:44Install Hook Abuse2026-09-01 16:45Install Hook Abuse2026-09-01 16:12
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 33
Updated 9 Oct 2026, 07:50 UTC. Ordered by latest scan.
@toothfairyai/tfcode@2.2.6
This is a concrete install-hook supply-chain risk: mutable remote executable content and unpinned user-wide Python packages are installed automatically. No credential theft was found, but...
@aui.io/apollo@0.1.46
The package uses postinstall to persist an evaluated command in multiple user shell configuration files. This automatic mutation of shell control files is a concrete install-hook abuse de...
@lystech/core@3.0.122
The automatic lifecycle hook persists a new CI workflow in consumer repositories and causes future network reporting to an external registry. This is unconsented install-time project muta...
squeez@1.48.2
The automatic postinstall executes unpinned remote code and uses it to register hooks in a foreign AI-agent environment. This is concrete install-hook abuse, not merely an explicit user-i...
