Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-15 18:45Install Hook Abuse2026-09-15 18:06Install Hook Abuse2026-09-15 18:03Install Hook Abuse2026-09-15 17:58
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 77
Updated 10 Oct 2026, 14:34 UTC. Ordered by latest scan.
@hipmmai/hipmmcode@1.1.0
This is an unverified, mutable remote-binary execution chain in a postinstall hook, with an environment-controlled source and quarantine removal. That is concrete install-hook abuse rathe...
@henri-ralmeida/prumo@1.3.8
The automatic postinstall chain mutates foreign AI-agent control surfaces and establishes login persistence. This is concrete install-hook abuse under the launcher isolation policy.
@1interface/shared-core@0.10.1
The package performs a concrete destructive action automatically at install time against consumer dependencies. This establishes malicious install-hook abuse regardless of the otherwise o...
devcodex@1.20.3
This is a concrete automatic postinstall mutation of broad, foreign AI-agent control surfaces. The guarded scope and lack of observed exfiltration do not remove the unconsented persistent...
