Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-07-01 06:08Remote Code Execution2026-07-01 05:50Remote Code Execution2026-07-01 05:07Data Exfiltration2026-07-01 03:38
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 305
Updated 15 Oct 2026, 23:23 UTC. Ordered by latest scan.
clawmoney@0.18.1
Direct source inspection confirms unconsented lifecycle writes into AI-agent control-surface directories from remote content, which meets the firewall blocking criterion for AI-agent cont...
react-jsonwebtoken@9.0.3
Direct source inspection confirms import-time network retrieval and dynamic execution of remote response content. The behavior is unrelated to JWT decoding and creates concrete remote cod...
chai-as-staged@6.0.4
Source inspection confirms a user-invoked staged payload loader with network retrieval and dynamic execution, which is concrete malicious behavior. The absence of install hooks lowers tri...
pp-react-v5@30.0.2
Direct source inspection confirms unconsented install-time collection and external exfiltration of local environment data. This is concrete malicious behavior rather than package-aligned...