Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-21 22:49Credential Exfiltration2026-08-21 21:56Data Exfiltration2026-08-21 19:21Soft block: AI-agent control surface2026-08-21 18:55
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 306
Updated 17 Oct 2026, 02:43 UTC. Ordered by latest scan.
@ainative/cody-cli@0.12.77
The package performs unconsented postinstall mutation of a foreign/broad Claude-compatible AI-agent control surface, including deleting credentials and replacing them with its own provide...
alpha-legend@1.0.0
Source establishes credential exfiltration to a hard-coded non-Facebook endpoint, including an automatic recovery trigger. No lifecycle hook is needed for this concrete runtime attack.
@alannxd/baileys@6.2.7
Source inspection confirms unsolicited import-time networking and a public helper that exfiltrates caller-supplied phone numbers to an unrelated host. The install hook itself is benign, b...
@nookplot/cli@0.7.58
The package performs concrete, unconsented postinstall writes to an existing AI-agent prompt/control surface. This meets the firewall block criterion regardless of the absence of observed...
