Loading npm security reports…
Skip to main contentMalware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35Malware2026-08-07 00:35
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 426
Updated 20 Oct 2026, 15:56 UTC. Ordered by latest scan.
wos-library-ui@99.0.0
OpenSSF/OSV malware advisory MAL-2026-13467 blocks this version. wos-library-ui@99.0.0 declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostnam...
remote-claude-daemon@0.5.9
OpenSSF/OSV malware advisory MAL-2026-13455 blocks this version. remote-claude-daemon connects to a hardcoded WebSocket relay at wss://remote-claude-relay.fly.dev and treats inbound messa...
vanexa-agent@1.1.46
OpenSSF/OSV malware advisory MAL-2026-10751 blocks this version. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay a...
vanexa-agent@1.1.45
OpenSSF/OSV malware advisory MAL-2026-10751 blocks this version. When the user runs `vanexa-agent start`, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay a...