Loading npm security reports…
Skip to main contentMalware2026-08-19 11:30Credential Exfiltration2026-08-19 11:24Staged Payload Carrier2026-08-19 10:48Soft block: AI-agent control surface2026-08-19 10:48
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 315
Updated 17 Oct 2026, 06:50 UTC. Ordered by latest scan.
evm-validation@1.0.3
OpenSSF/OSV malware advisory MAL-2026-14301 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package advertises EVM address validation but pe...
@kody-ade/kody-engine@0.4.610
Source confirms an automated credential upload path, not merely network or environment-variable use. Lack of npm lifecycle hooks does not mitigate the generated CI workflow's secret exfil...
francois@0.29.0
The digest check limits transport tampering but does not mitigate the package's explicit purpose of bypassing OS trust warnings for an unsigned remote binary. This is concrete malicious i...
warden-ai@0.5.4
The postinstall hook performs broad foreign agent-control mutations with no user command or consent, including automatic approval and tool-interception hooks. This meets the blocking poli...