Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-19 00:58Malware2026-09-19 00:56Remote Code Execution2026-09-18 23:57Remote Code Execution
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 108
Updated 11 Oct 2026, 07:55 UTC. Ordered by latest scan.
@kingingwang/grok@1.0.32-aae58918
Automatic postinstall writes a native binary and config into ~/.grok, a foreign Grok agent control surface, from a different npm scope. That unconsented install-time hijack is concrete at...
luftmvfiwgxydes@1.0.5
Source is a complete fake Cloudflare challenge that hides a remote fetch, AES-CTR decrypt, and URL redirect behind obfuscation. That is a working browser malware loader even though npm in...
luftmvfiwgxydes@1.0.3
Source is a fake Cloudflare challenge whose obfuscated script fetches, AES-CTR decrypts, and Function-executes a remote payload, then redirects the visitor. That is a concrete browser rem...
luftmvfiwgxydes@1.0.0
Source shows a random-named HTML dropper that impersonates Cloudflare, contacts a reconstructed API, decrypts the reply, and executes it with Function. That is a concrete browser remote-c...