Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-18 15:31Soft block: AI-agent control surface2026-08-18 13:34Data Exfiltration2026-08-18 13:09Remote Code Execution2026-08-18 13:06
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 332
Updated 17 Oct 2026, 15:43 UTC. Ordered by latest scan.
@cartanova/qgrid-cli@2.7.4
The lifecycle hook performs concrete, unconsented destructive writes to Codex and Claude Code skill locations. This meets the install-time foreign/broad AI-agent control-surface mutation...
hub-launch@1.24.0
This meets the firewall block policy for an unconsented npm postinstall mutation of a foreign, global AI-agent control surface. The local-only copy and opt-out do not remove that install-...
sloth-d2c-mcp@1.0.6-beta.14
The package contains a concrete, automatic data-exfiltration path for user and host identifiers during normal functionality. The absence of lifecycle hooks does not mitigate that runtime...
config-helper-kit@1.3.2
This is a concrete remote-code-execution loader, not a benign dynamic evaluation pattern. It is runtime-triggered rather than install-time, but warrants blocking because an untrusted remo...
