Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-29 02:49Install Hook Abuse2026-09-29 01:27Malware2026-09-28 22:50Malware2026-09-28 22:50
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 37
Updated 9 Oct 2026, 09:58 UTC. Ordered by latest scan.
@lovrabet/rabetbase-cli@2.5.4
The automatic lifecycle chain mutates a broad AI-agent control surface and downloads current external installer code through npx. This meets the install-hook abuse blocking boundary.
@jenga-ai/agent@4.1.0
The automatic post-install chain mutates foreign AI-agent configuration and installs executable lifecycle hooks without interactive consent. This is concrete install-hook abuse under the...
mini-hardhat@1.1.4
OpenSSF Malicious Packages via OSV confirms mini-hardhat@1.1.4 as malicious (MAL-2026-17236): Malicious code in mini-hardhat (npm)
test-agency-assignment@1.0.2
OpenSSF Malicious Packages via OSV confirms test-agency-assignment@1.0.2 as malicious (MAL-2026-17239): Malicious code in test-agency-assignment (npm)