Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-08-30 23:02Install Hook Abuse2026-08-30 22:52Install Hook Abuse2026-08-30 22:10Install Hook Abuse2026-08-30 21:22
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. These reports include LPM Firewall detections. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 37
Updated 9 Oct 2026, 10:49 UTC. Ordered by latest scan.
@phnx-labs/agents-cli@1.22.66
The automatic lifecycle hook creates persistent user-level background execution. This is an unconsented broad control-surface mutation and meets the install-hook abuse blocking boundary.
llm-relay@0.65.1
The source establishes automatic postinstall mutation of broad, foreign AI-agent control surfaces. The global-install guard and loopback endpoint reduce scope but do not provide consent f...
litclaude-ai@0.4.3
This is an unconsented postinstall mutation of a broad AI-agent control surface, combined with a runtime same-package update chain. The source establishes the complete install-hook abuse...
llm-relay@0.64.1
The source establishes a concrete automatic lifecycle path that modifies foreign AI-agent settings and agent definitions, then persists it through automatic global self-updates. This meet...
