Loading npm security reports…
Skip to main contentMalware2026-08-20 14:00Protestware2026-08-20 13:09Soft block: AI-agent control surface2026-08-20 13:05Remote Code Execution2026-08-20 12:59
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 311
Updated 17 Oct 2026, 04:42 UTC. Ordered by latest scan.
invest-module-cookie@20.8.2
OpenSSF/OSV malware advisory MAL-2026-12393 blocks this version. On require('invest-module-cookie'), index.js loads _adapter.js which selects an OS-specific asset path, downloads an opaqu...
konnektive-one@1.2.3
Source inspection confirms concrete, targeted browser disruption and unsolicited remote audio playback in the package main bundle. This is protestware, independent of the absence of insta...
@wowok/skills@2.2.1
The lifecycle script performs the concrete broad agent-control-surface mutation that the firewall policy reserves for blocking. Although the configuration is branded Wowok and no direct c...
tonty-tech-interviews@0.2.66
The package has no install-time hook, but its normal cloud-join path executes unvalidated remote commands and a downloaded shell script, then uploads captured interactive terminal data. T...