Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-28 06:57Soft block: AI-agent control surface2026-09-28 06:53Credential Exfiltration2026-09-28 06:47Soft block: AI-agent control surface2026-09-28 06:32Soft block: AI-agent control surface2026-09-28 06:15Remote Code Execution2026-09-28 06:07Credential Exfiltration2026-09-28 06:07Install Hook Abuse2026-09-28 06:06Soft block: AI-agent control surface2026-09-28 05:58Soft block: AI-agent control surface2026-09-28 05:36Malware2026-09-28 05:36Data Exfiltration2026-09-28 05:35Soft block: AI-agent control surface2026-09-28 05:29Soft block: AI-agent control surface2026-09-28 05:27Soft block: AI-agent control surface2026-09-28 05:20Soft block: AI-agent control surface2026-09-28 04:52Soft block: AI-agent control surface2026-09-28 04:43Remote Code Execution2026-09-28 04:34Persistence2026-09-28 04:19Soft block: AI-agent control surface2026-09-28 04:04Soft block: AI-agent control surface2026-09-28 04:03Soft block: AI-agent control surface2026-09-28 03:54Data Exfiltration2026-09-28 03:43Soft block: AI-agent control surface2026-09-28 03:42Soft block: AI-agent control surface2026-09-28 03:42
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 24
Updated 8 Oct 2026, 23:50 UTC. Ordered by latest scan.
@impakers/debug@1.9.8
The package performs an automatic postinstall write to a consumer project's .claude skill directory. This concrete AI-agent control-surface mutation meets the publish-block policy.
@haus-tech/haus-workflow@5.10.1
The automatic global lifecycle path installs persistent Claude Code hooks and agent configuration. This meets the policy threshold for blocking unconsented install-time mutation of a broa...
@bobfrankston/rmfmail@1.2.347
The package automatically exports potentially credential-bearing account settings to a package-controlled, unrelated endpoint. This is concrete credential exfiltration rather than ordinar...
@ornexus/neocortex@4.60.50
The automatic global-install chain reaches a user-level Claude agent configuration with no interactive consent. This meets the install-control-surface blocking condition.
@titan-design/active-work@0.11.0
The automatic lifecycle hook makes unconsented changes to Claude Code's skill and command directories. This meets the install-control-surface blocking policy.
@javascribe/pindoupic@0.3.0
Opaque bundled code is decrypted using remotely supplied material and actively executed through the Function constructor. This is a concrete remote code execution path, not an inert encry...
@bobfrankston/rmfmail@1.2.348
The source implements active, silent transmission of account configuration to an unrelated endpoint, including data that can contain IMAP credentials. This is concrete credential exfiltra...
api-nebula@1.0.0
The automatic lifecycle hook combines deliberate obfuscation, staged payload handling, filesystem writes, and process execution. This meets the install-hook abuse boundary for blocking pu...
@wowok/skills@3.2.4
The automatic lifecycle chain performs broad AI-agent configuration mutation and installs an additional executable MCP dependency. This meets the install-control-surface blocking rule.
relia-sdk@0.2.44
The package automatically rewrites a consumer application's AI module resolution during postinstall, then transmits intercepted AI run contents. This is a concrete unconsented AI-agent co...
native-env@1.0.1
Hidden extraction and detached execution of an opaque PowerShell payload is concrete malware behavior, not environment configuration functionality. Automatic activation from both runtime...
git-en-boite-logging@0.0.0
The package contains a concrete automatic install-time collection and outbound transmission of local system identifiers. This is malicious data exfiltration rather than ordinary package s...
@social-data/social-neuron-opinion-query@1.0.1
The automatic lifecycle hook performs broad OpenClaw skill installation without user invocation. This meets the install-time AI-agent control-surface mutation block policy.
@social-data/social-neuron-opinion-query@1.0.3
The package performs an automatic postinstall overwrite of the user's OpenClaw skills directory. This meets the install-time AI-agent control-surface mutation block policy.
sprag-cli@3.54.0
The automatic lifecycle path modifies global Claude Code configuration and registers future agent hooks without consent. This meets the install-control-surface blocking boundary.
karajan-code@4.31.1
The automatic postinstall hook mutates two foreign, global AI-agent control surfaces and installs executable MCP entries without user consent. This meets the install-control-surface block...
@agentgates/cli@0.58.0
The automatic post-install hook persistently modifies broad AI-agent configuration files and injects package-preference instructions. This meets the blocking policy for unconsented lifecy...
dotenv-native@1.0.1
The package contains and automatically activates a hidden encoded-PowerShell launcher from both its library and CLI entrypoints. This is concrete malicious execution behavior unrelated to...
mt-tech@1.0.12
The hidden import-time request interception, recurring daemon, and remote update mechanism are unrelated to a general CLI and are concealed by obfuscation. This is concrete malicious pers...
@tera-system/core@0.4.1
The automatic lifecycle hook modifies the consumer's .opencode configuration and agent content. That is concrete install-hook abuse under the stated policy.
@tera-system/pro@0.2.27
The postinstall hook performs unconsented mutation of a consumer AI-agent control surface and applies remote package-controlled content. Signature checks limit third-party tampering but d...
@nerdev/skillset@0.2.3
The automatic npm lifecycle performs broad AI-agent configuration mutation without an explicit user command or target selection. This meets the install-control-surface blocking rule even...
engine7@7.1.112
The source establishes a default-enabled reporting loop that exports identifiable installation, host, path, and user-activity metadata to a hard-coded third-party endpoint. No install hoo...
@ornexus/neocortex@4.60.44
The automatic global lifecycle chain modifies Claude agent configuration and can remove existing matching paths. This meets the blocking policy for unconsented postinstall mutation of a f...
@ornexus/neocortex@4.60.47
The automatic lifecycle chain mutates and deletes user AI-agent configuration outside the installed package. This is a concrete unconsented install-hook control-surface attack.