Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-19 03:32Remote Code Execution2026-09-19 02:05Malware2026-09-19 01:00Soft block: AI-agent control surface2026-09-19 00:58
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 44
Updated 9 Oct 2026, 14:42 UTC. Ordered by latest scan.
langcli-com@0.1.44
The postinstall hook drives a third-party Chrome MCP bridge to register a native messaging host without a user command, which is unconsented mutation of a foreign AI-agent control surface...
@onescience/onecode@1.14.50-202609190953
Postinstall downloads and installs an unsigned native binary from a hardcoded IP with TLS verification disabled, then the CLI executes it. That is a concrete remote payload chain, not a f...
luftmvfiwgxydes@1.0.4
Source shows a fake Cloudflare interstitial whose obfuscated script fetches, AES-decrypts, and follows a remote redirect_url. That is concrete malware behavior even though npm install its...
@kingingwang/grok@1.0.32-aae58918
Automatic postinstall writes a native binary and config into ~/.grok, a foreign Grok agent control surface, from a different npm scope. That unconsented install-time hijack is concrete at...