Loading npm security reports…
Skip to main contentData Exfiltration2026-09-15 00:50Malware2026-09-15 00:50Soft block: AI-agent control surface2026-09-15 00:38Credential Exfiltration2026-09-15 00:26
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 131
Updated 11 Oct 2026, 21:48 UTC. Ordered by latest scan.
discord-players@3.4.2
This is concrete user-triggered bulk file exfiltration to a source-controlled Telegram destination, inconsistent with the package identity. The absence of an install hook does not remove...
kamafhbnowct@1.0.1
This is a concealed browser redirector packaged as an npm module, with a fake Cloudflare challenge used to gate navigation. The obfuscation and encrypted destination conceal a concrete ph...
wayari@0.5.0
The automatic lifecycle chain performs unconsented global AI-agent MCP registration. This is concrete install-hook abuse even though no secret theft or network exfiltration was found in t...
@co0ontty/wand@4.63.0
The browser extension combines broad page access, credential collection, and transmission to a hard-coded external host. The lack of an npm install hook does not mitigate this concrete cr...