Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-12 00:21Install Hook Abuse2026-09-12 00:05Install Hook Abuse2026-09-12 00:03Install Hook Abuse2026-09-11 23:55
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 86
Updated 10 Oct 2026, 20:09 UTC. Ordered by latest scan.
@lifeaitools/clauth@2.15.17
The automatic postinstall hook establishes privileged, hidden persistence and installs extra software on Windows. These actions are concrete install-hook abuse regardless of the package's...
@lifeaitools/clauth@2.15.16
The lifecycle hook creates privileged persistence and installs software automatically, establishing a concrete install-hook abuse path. The source also contains an explicit scanner-avoida...
@softize/opus@17.0.0
The automatic lifecycle chain modifies consumer AI-agent configuration and adds a hook that can block agent session termination. This meets the install-hook abuse blocking policy.
@lifeaitools/clauth@2.15.15
This is concrete install-hook abuse: an automatic lifecycle hook establishes elevated persistence and makes unrelated system and project changes. The behavior is not limited to explicit u...
