Loading npm security reports…
Skip to main contentCredential Exfiltration2026-09-18 13:55Credential Exfiltration2026-09-18 13:55Data Exfiltration2026-09-18 13:54Data Exfiltration2026-09-18 13:54
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 110
Updated 11 Oct 2026, 09:03 UTC. Ordered by latest scan.
pf23727@1.0.0
This is concrete, automatic credential and application-data exfiltration from the package entry point. The fixed external receiver and immediate execution establish malicious behavior.
pflag29424@1.0.0
The source contains a complete, import-triggered data-exfiltration path to an unrelated external webhook. This is concrete malicious behavior even though it has no install hook.
@pisell/pisellos@0.10.23
The package embeds package-controlled remote logging defaults and automatically transmits rich application records during ordinary ScanOrder use. This is concrete data exfiltration rather...
@pisell/pisellos@0.10.26
The package embeds active third-party webhook destinations and automatically sends rich runtime records to them during normal ScanOrder use. The absence of an install hook does not mitiga...