Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-31 18:53Credential Exfiltration2026-08-31 18:47Malware2026-08-31 18:45Malware2026-08-31 18:45
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 248
Updated 14 Oct 2026, 15:52 UTC. Ordered by latest scan.
@inizioevoke/astro-core@3.2.2
This package has a concrete, automatic postinstall chain that overwrites a consumer Claude skill with broad activation instructions. Under the install-control-surface policy, that is mali...
icoa-cli@2.19.593
The package contains a concrete remote collection path for an exam credential and user shell input, activated as part of its exam workflow. Its absence of install hooks does not mitigate...
module-relpath@1.0.3
OpenSSF/OSV malware advisory MAL-2026-14561 blocks this version. The package presents itself as `relative-import-path` (README title, homepage and repository URL point at github.com/marko...
module-relpath@1.0.2
OpenSSF/OSV malware advisory MAL-2026-14561 blocks this version. The package presents itself as `relative-import-path` (README title, homepage and repository URL point at github.com/marko...