Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-08-31 19:56Install Hook Abuse2026-08-31 19:49Install Hook Abuse2026-08-31 19:33Install Hook Abuse2026-08-31 19:18
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 35
Updated 9 Oct 2026, 09:17 UTC. Ordered by latest scan.
llm-relay@0.68.4
Direct inspection confirms automatic postinstall mutation of foreign AI-agent configuration and agent files. The global-only guard limits scope but does not provide separate consent for t...
@codyswann/lisa@4.27.1
The package contains a concrete automatic install-time chain that modifies consumer lifecycle scripts and AI-agent control surfaces, then persists and replays those changes. This meets th...
@codyswann/lisa@4.27.0
The reviewed source establishes an automatic postinstall chain that mutates a foreign project and user-wide AI-agent configuration, with detached persistence of its changes. That concrete...
llm-relay@0.68.3
This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with instructions that autonomously redirect agent work and a self-update path that repeats...
