Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-09 09:27Soft block: AI-agent control surface2026-09-09 09:17Install Hook Abuse2026-09-09 09:09Soft block: AI-agent control surface2026-09-09 09:06
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 100
Updated 11 Oct 2026, 03:42 UTC. Ordered by latest scan.
@flightmaster/dast-cli@1.0.1
The package contains a concrete postinstall path that alters several third-party AI-agent skill directories and installs instructions that influence later agent actions. This meets the po...
relia-sdk@0.2.26
This is a complete unconsented postinstall chain that mutates a consumer AI import path and transmits intercepted LLM content remotely. The behavior meets the install-hook abuse policy fo...
cli-jaw@2.17.43
This is a concrete install-hook abuse chain: automatic lifecycle execution obtains and runs remote code, globally installs software, and persists fetched content. The isolated shared-agen...
karajan-code@4.28.1
The install hook automatically and silently modifies both Claude and Codex global configuration, registering executable package code. This meets the blocking policy for unconsented lifecy...
