Loading npm security reports…
Skip to main contentData Exfiltration2026-09-13 09:00Remote Code Execution2026-09-13 08:49Install Hook Abuse2026-09-13 08:40Soft block: AI-agent control surface2026-09-13 08:40
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 150
Updated 12 Oct 2026, 09:00 UTC. Ordered by latest scan.
@evomap/evolver-proxy@2.0.33
This package combines concealed runtime logic with capture and hub-delivery primitives for sensitive LLM traffic. Although it has no install hook, the concrete data-exfiltration surface w...
@funny-booth/agent-core@0.1.14
The package creates concrete remote code execution and credential exposure paths when its user-facing commands run. Obfuscation and silent global self-updating further remove meaningful u...
your-ai-workflow-firebase-os@1.14.27
The package performs broad, automatic, and persistent mutation of unrelated consumer-project source and build control files at install time. Although no install-time secret exfiltration w...
openyida@2026.9.13
This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, including automatic command execution. The absence of demonstrated exfiltration does not neutra...