Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-08-30 22:10Soft block: AI-agent control surface2026-08-30 22:09Soft block: AI-agent control surface2026-08-30 21:48Install Hook Abuse2026-08-30 21:22
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 254
Updated 14 Oct 2026, 18:50 UTC. Ordered by latest scan.
litclaude-ai@0.4.3
This is an unconsented postinstall mutation of a broad AI-agent control surface, combined with a runtime same-package update chain. The source establishes the complete install-hook abuse...
elia-ai@0.1.4
The install-time hook creates an unconsented AI-agent control-surface mutation and hides errors. This is concrete install-hook abuse even though the rest of the application includes ordin...
llm-relay@0.64.2
This package automatically changes foreign AI-agent instruction and configuration surfaces during global installation, and its injected instructions explicitly remove operator consent fro...
llm-relay@0.64.1
The source establishes a concrete automatic lifecycle path that modifies foreign AI-agent settings and agent definitions, then persists it through automatic global self-updates. This meet...