Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 423
Updated 20 Oct 2026, 14:23 UTC. Ordered by latest scan.
move-bcs-codec@1.0.1
OpenSSF/OSV malware advisory MAL-2026-13450 blocks this version. move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install...
move-bcs-codec@1.0.0
OpenSSF/OSV malware advisory MAL-2026-13450 blocks this version. move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install...
@vanexalabs-ai/vanexa-agent@1.3.62
OpenSSF/OSV malware advisory MAL-2026-13397 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package implements a daemon that pairs with a re...
poc-ch4rlygr@1.1.0
OpenSSF/OSV malware advisory MAL-2026-13454 blocks this version. On require()/import, index.js collects os.hostname(), os.arch(), __dirname, os.userInfo().username, and the full contents...