Loading npm security reports…
Skip to main contentCredential Exfiltration2026-08-24 06:41Soft block: AI-agent control surface2026-08-24 06:40Soft block: AI-agent control surface2026-08-24 06:29Remote Code Execution2026-08-24 06:24
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 161
Updated 12 Oct 2026, 14:54 UTC. Ordered by latest scan.
icoa-cli@2.19.541
Source directly implements remote transmission of sensitive interactive-command and identity data, not merely package-aligned challenge submission. The absence of an install hook does not...
@lijuneleven/iris@0.2.8
The package’s own source establishes an install-time chain from remote executable download to automatic Codex/Claude hook setup. That matches the blocking policy even though the JavaScrip...
@lijuneleven/iris@0.2.7
This is a concrete unconsented postinstall chain that downloads and executes an opaque binary to modify foreign AI-agent control surfaces. It meets the install-control-surface block bound...
dexrelay@0.1.73
The package performs concrete install-time persistence and exposes arbitrary command execution over a 0.0.0.0 WebSocket listener without source-visible authentication. Its platform/global...