Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-08-06 00:00Soft block: AI-agent control surface2026-08-05 23:30Soft block: AI-agent control surface2026-08-05 23:06Soft block: AI-agent control surface2026-08-05 22:56
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 458
Updated 21 Oct 2026, 11:26 UTC. Ordered by latest scan.
cursor-browser-cli@1.0.0
This is a concrete, unconsented postinstall mutation of foreign/broad AI-agent control surfaces. Localhost-only networking does not mitigate the install-time agent configuration changes.
local-mcp@3.0.363
This is an unconsented postinstall mutation of broad third-party AI-agent control surfaces, coupled with an unverified remote native-payload chain and persistence. The guards and careful...
@xfive/chisel-ai-toolkit@1.0.0
Although the installed content is package-aligned and no exfiltration or remote execution was found, the npm postinstall automatically installs behavior-bearing Claude Code configuration...
llm-interceptor@0.3.8
This is concrete unconsented postinstall mutation of broad AI-agent control surfaces coupled with persistence and remote egress. The later consent gate does not undo or precede the instal...
