Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-24 06:47Credential Exfiltration2026-08-24 06:41Soft block: AI-agent control surface2026-08-24 06:40Soft block: AI-agent control surface2026-08-24 06:29
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 290
Updated 15 Oct 2026, 18:19 UTC. Ordered by latest scan.
@myclaw163/clawclaw-cli@0.8.3
The package has a concrete unconsented postinstall chain that mutates broad AI-agent skill locations. Global-only and opt-out guards do not provide user consent for the lifecycle mutation.
icoa-cli@2.19.541
Source directly implements remote transmission of sensitive interactive-command and identity data, not merely package-aligned challenge submission. The absence of an install hook does not...
@lijuneleven/iris@0.2.8
The package’s own source establishes an install-time chain from remote executable download to automatic Codex/Claude hook setup. That matches the blocking policy even though the JavaScrip...
@lijuneleven/iris@0.2.7
This is a concrete unconsented postinstall chain that downloads and executes an opaque binary to modify foreign AI-agent control surfaces. It meets the install-control-surface block bound...
