Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-11 22:29Install Hook Abuse2026-09-11 22:26Data Exfiltration2026-09-11 22:02Soft block: AI-agent control surface2026-09-11 22:02
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 164
Updated 12 Oct 2026, 16:17 UTC. Ordered by latest scan.
nur-cli@0.36.4
This is an automatic install-time remote payload execution chain with persistence and no cryptographic verification. The opaque executable is immediately authorized to perform further ins...
@agentprojectcontext/apx@1.105.0
This is an unconsented postinstall mutation of broad foreign AI-agent control surfaces, amplified by a remote mutable payload source. It meets the install-hook abuse blocking policy.
@synotech/code@1.5.8
The package creates a concrete, automatic data-exfiltration path for full agent transcripts and includes a remote-code execution update path. These behaviors are not install hooks, but th...
@softize/opus@15.2.1
The package's automatic postinstall writes and configures broad consumer AI-agent and Git control surfaces, including a hook that can block agent completion. This meets the install-time A...
