Loading npm security reports…
Skip to main contentData Exfiltration2026-08-14 03:04Persistence2026-08-14 02:10Malware2026-08-14 02:04Persistence2026-08-14 02:01
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 367
Updated 19 Oct 2026, 10:04 UTC. Ordered by latest scan.
m2fcsfyjkuxb@1.0.0
Source inspection confirms a deliberately obfuscated, unconditional browser redirect that forwards query parameters after a deceptive verification screen. The absence of install hooks lim...
@biklitime/biklimaster@1.1.12
The install-time hook performs concrete privileged persistence and remote-access weakening, not merely a user-invoked administrative utility. No exfiltration endpoint is needed for this h...
@biklitime/biklimaster@1.1.11
The malicious remote-access configuration executes automatically at install time and materially weakens host authentication and visibility. It is not merely an installer primitive or an e...
@biklitime/biklimaster@1.1.10
Concrete postinstall behavior creates a hidden privileged remote-access path and weakens RDP security. This exceeds a benign installer’s expected scope and is executed automatically on in...
