Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-15 03:33Install Hook Abuse2026-09-15 03:28Install Hook Abuse2026-09-15 03:13Install Hook Abuse2026-09-15 03:00
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 79
Updated 10 Oct 2026, 15:39 UTC. Ordered by latest scan.
@jenga-ai/agent@3.4.0
The automatic lifecycle hook broadly mutates foreign AI-agent control surfaces and registers package-owned command callbacks. This meets the install-hook abuse blocking policy despite no...
@agentprojectcontext/apx@1.111.0
The install hook mutates broad, foreign AI-agent control surfaces and accepts remotely fetched instruction content. This is concrete unconsented install-hook abuse.
@chenronggui/codex-win-patch@0.153.4-patch.7
The source establishes a complete automatic postinstall chain that overwrites executables owned by @openai/codex. Backup and hash checks do not mitigate the unconsented replacement of the...
termdock@1.4.220
This is unconsented install-time host mutation with automatic privileged package-manager execution, and it persists as a retrying runtime behavior. It is not required for ordinary depende...
