Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-18 05:47Soft block: AI-agent control surface2026-08-18 05:46Soft block: AI-agent control surface2026-08-18 04:42Credential Exfiltration2026-08-18 03:34
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 174
Updated 12 Oct 2026, 21:59 UTC. Ordered by latest scan.
@lifeaitools/clauth@1.30.24
The automatic postinstall path mutates Windows Terminal profiles used to launch Claude and Codex and creates elevated persistence. These actions occur without an explicit user setup command.
@lifeaitools/clauth@1.30.25
This is concrete unconsented postinstall persistence plus mutation of a foreign AI-agent control surface. The absence of observed remote exfiltration does not mitigate the lifecycle attac...
@xzy-ai/pi-c2@0.0.4
The source confirms an automatic postinstall overwrite of a foreign Pi coding-agent host, expanding its extension API. This is a concrete unconsented AI-agent control-surface mutation.
@clawos-dev/clawd@0.2.364
This is concrete, unconsented credential delegation from a foreign Claude configuration into guest-controlled agent sessions. The absence of lifecycle hooks does not mitigate the runtime...