Loading npm security reports…
Skip to main contentData Exfiltration2026-08-22 22:38Data Exfiltration2026-08-22 22:33Install Hook Abuse2026-08-22 21:47Malware2026-08-22 21:35
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 165
Updated 12 Oct 2026, 16:52 UTC. Ordered by latest scan.
stillm4ddpocs-rtest-alpha@999.9.10
This is concrete, unconsented install-time reconnaissance and exfiltration from the consuming environment. Research-oriented labels do not remove the external data-transfer attack surface.
stillm4ddpocs-demo-sprocket@999.9.20
This is concrete unconsented preinstall-time data exfiltration from the consuming environment through multiple external channels. The absence of credential theft or persistence does not m...
dsh-oc@0.1.8
The verified install-time chain performs unconsented hosts-file/DNS mutation and drops launch artifacts. This is concrete harmful behavior, not merely a user-invoked installer.
hydration-dim-kit@1.0.0
The package executes a bundled native payload at import time, and its embedded credential, exfiltration, and persistence indicators establish a concrete malicious chain. Absence of an npm...