Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-20 01:30Install Hook Abuse2026-09-20 00:07Install Hook Abuse2026-09-19 23:52Install Hook Abuse2026-09-19 19:27
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 72
Updated 10 Oct 2026, 11:25 UTC. Ordered by latest scan.
agent-takkub@2.1.23
The lifecycle script performs a global foreign AI-agent installation and persistent shell mutation without requiring an explicit user setup command. This meets the install-control-surface...
@mark-gozner/aigile-method@1.5.1
The automatic lifecycle hook mutates consumer AI-agent control surfaces and project metadata without an explicit user setup action. This meets the install-hook abuse blocking policy even...
termdock@1.4.83
Automatic install-time deletion, compilation, and attempted privileged system software installation create a concrete unsafe install-hook attack surface. The behavior warrants blocking ev...
openrp-toolkit@1.1.6
The automatic postinstall hook silently mutates foreign AI-agent control surfaces, meeting the install-hook abuse blocking policy. The unrestricted MCP request path adds a concrete condit...
