Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-05 09:23Soft block: AI-agent control surface2026-09-05 09:23Install Hook Abuse2026-09-05 09:06Soft block: AI-agent control surface2026-09-05 08:52
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 118
Updated 11 Oct 2026, 14:10 UTC. Ordered by latest scan.
@paytaca/opencode-plugin@0.3.1
This is malicious install-hook abuse: an automatic lifecycle hook mutates foreign OpenCode project configuration, lockfiles, and caches to control the installed plugin version. Runtime co...
devez-vibe@1.7.63
The automatic postinstall hook mutates broad, foreign AI-agent configuration surfaces and the user's Python environment. This meets the install-control-surface blocking policy regardless...
@gogovega/firebase-config-node@0.4.0
The automatic postinstall remote-code execution is a concrete supply-chain attack surface, not a user-invoked feature. Its mutable unverified payload warrants blocking publication.
@devflow-tools/devflow@0.18.9
The automatic postinstall lifecycle mutates the consumer's Claude Code configuration and registers package code for every tool action. This meets the policy threshold for malicious AI-age...
