Loading npm security reports…
Skip to main contentData Exfiltration2026-09-11 01:34Data Exfiltration2026-09-11 01:34Malware2026-09-11 01:29Malware2026-09-10 19:00
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 176
Updated 12 Oct 2026, 22:56 UTC. Ordered by latest scan.
@bobfrankston/rmfmail@1.2.315
The package contains a concrete, automatic data-exfiltration path to a package-controlled host. Its narrow postinstall hook does not remove the runtime privacy and credential-context risk.
@bobfrankston/rmfmail@1.2.312
The package contains an always-on remote logging channel that captures console output and explicitly transmits account metadata to an external host. The install hook is limited, but it do...
luftzxyuiwgbgsp@1.0.1
This is a concealed, active redirect payload packaged as an npm module. Although it has no install hook, its runtime browser behavior is concrete and deceptive.
tailwindcss-contact-forms@0.6.0
OpenSSF/OSV malware advisory MAL-2026-16124 blocks this version. The package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied ver...
