Loading npm security reports…
Skip to main contentCredential Exfiltration2026-09-22 00:02Data Exfiltration2026-09-22 00:02Credential Exfiltration2026-09-22 00:02Malware
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 100
Updated 11 Oct 2026, 02:59 UTC. Ordered by latest scan.
siriusbeyond@1.0.0
This is concrete, unconsented install-time data exfiltration with redundant network channels. The package's research label does not neutralize the automatic behavior.
@siriusbeyond/ui@99.0.0
The automatic lifecycle hooks activate host and environment reconnaissance and transmit the results to an unrelated external Telegram recipient. The behavior is concrete install-time data...
starbucks-sdk@1.0.0
This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.
sysverify@2.0.10
The source implements deceptive process disguise, persistence, covert screen capture, and external transmission rather than the advertised DOM diagnostic function. These concrete behavior...