Loading npm security reports…
Skip to main contentData Exfiltration3 days ago 05:31Soft block: AI-agent control surface3 days ago 04:37Soft block: AI-agent control surface3 days ago 04:30Soft block: AI-agent control surface
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 10
Updated 8 Oct 2026, 13:36 UTC. Ordered by latest scan.
@inpeek/odata-angular@99.99.99
Source inspection confirms automatic disclosure of machine information to a fixed external recipient. The package's security-research claims do not establish authorization for this instal...
@telora/mcp-products@0.22.175
Inspected source proves unconsented install-time mutation of a foreign, global AI-agent control surface. This meets the blocking policy even though the commands are Telora-related and no...
local-mcp@3.0.418
The automatic global-install chain activates foreign AI-client configuration without a consent step, meeting the blocking policy for install-time agent control-surface mutation. Package-a...
@vanillagreen/pi-web-tools@3.0.1
The user-wide fallback makes this an automatic mutation of a broad AI-agent control surface, rather than setup confined to package-owned extension state. This meets the supplied blocking...