Loading npm security reports…
Skip to main contentCredential Exfiltration2026-09-21 23:55Credential Exfiltration2026-09-21 23:54Install Hook Abuse2026-09-21 23:52
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 101
Updated 11 Oct 2026, 03:40 UTC. Ordered by latest scan.
npmscript_tesstalert_unpkg@1.0.1
The sole published entrypoint contains direct browser-cookie exfiltration to an unrelated webhook endpoint. This is concrete malicious behavior rather than a package-aligned client request.
npmscript_tesstalert_unpkg@1.0.2
The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.
chat-adapter-matrix@99.99.99
The package uses automatic install hooks solely to make an external request to an unrelated endpoint. Although no credential theft or local mutation was found, this is concrete unsolicite...
npmscript_tesstalert_unpkg@1.1.7
OpenSSF Malicious Packages via OSV confirms npmscript_tesstalert_unpkg@1.1.7 as malicious (MAL-2026-16309): Malicious code in npmscript_tesstalert_unpkg (npm)