Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-09 10:54Install Hook Abuse2026-09-09 09:39Install Hook Abuse2026-09-09 09:09Install Hook Abuse2026-09-09 08:44
npm threat feed
npm malware reports, with evidence.
Explore malware, protestware, install-hook abuse, staged payload carriers, crypto mining, and typosquatting. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 93
Updated 11 Oct 2026, 00:24 UTC. Ordered by latest scan.
your-ai-workflow-firebase-os@1.14.17
This is concrete, automatic, destructive mutation of a consumer project at install time, with build-time restoration of package-controlled files. The absence of installer exfiltration doe...
devcodex@1.20.2
The package has a concrete automatic postinstall path that mutates several unrelated user-level AI-agent control surfaces. No self-dependency or exfiltration was needed to establish insta...
cli-jaw@2.17.43
This is a concrete install-hook abuse chain: automatic lifecycle execution obtains and runs remote code, globally installs software, and persists fetched content. The isolated shared-agen...
codexskin-hub@0.4.8
The automatic postinstall chain modifies another package's launcher and renderer, then makes the modification self-healing and persistent across normal launches. This meets the install-ho...
