Loading npm security reports…
Skip to main contentRemote Code Execution2026-07-09 00:52Soft block: AI-agent control surface2026-07-09 00:27Soft block: AI-agent control surface2026-07-09 00:10Soft block: AI-agent control surface2026-07-08 22:56
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 294
Updated 15 Oct 2026, 17:07 UTC. Ordered by latest scan.
tailwind-core@4.3.2
Static source inspection confirms concrete malicious behavior: host fingerprint exfiltration and remote code execution through a time-gated C2 loop. Absence of install hooks only narrows...
@skylence-ai/skyline@1.0.57
The reviewed JS wrapper has no direct exfiltration or payload obfuscation, but its lifecycle hook automatically triggers documented agent/daemon setup. Under the install control surface p...
port-authority-agent-terminal-mcp@0.3.10
Although the package appears aligned with local port/browser coordination and I found no exfiltration, its postinstall performs unconsented mutation of foreign AI-agent MCP control surfac...
mcp-efficiency-engine@0.1.0
Source inspection confirms unconsented postinstall mutation of foreign AI-agent control files, which meets the firewall block policy even without exfiltration. Bootstrap/network-heavy set...