Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-13 13:50Install Hook Abuse2026-09-13 13:49Install Hook Abuse2026-09-13 13:47Soft block: AI-agent control surface2026-09-13 13:45
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 148
Updated 12 Oct 2026, 07:57 UTC. Ordered by latest scan.
sprag-cli@3.40.0
The automatic postinstall path persistently mutates global Claude Code control files and registers future command execution without installation-time consent. This meets the install-hook...
ansi-tint@1.4.6
This package has no legitimate need to modify a consumer project to provide ANSI formatting. The automatic, deceptive postinstall write is concrete install-hook abuse.
claude-token-saver@3.40.0
The package automatically installs persistent Claude Code hooks and a controlled skill during npm postinstall, while explicitly bypassing prompts when unattended. That is concrete install...
secretloop@0.2.1
The source contains a concrete AI-agent control message that attempts to override independent judgment. Although there is no npm install hook and verification is opt-in, this package-supp...