Loading npm security reports…
Skip to main contentRemote Code Execution2026-08-05 17:47Remote Code Execution2026-08-05 17:47Remote Code Execution2026-08-05 17:47Remote Code Execution2026-08-05 17:45
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 476
Updated 21 Oct 2026, 23:39 UTC. Ordered by latest scan.
boxy-render-unwrap@35.7.9
The malicious chain is concrete, reachable at import time, and silently executes unverified remote bytes. No lifecycle hook is needed for this runtime compromise.
boxy-page-story@35.8.5
This is a concrete import-time staged payload and execution chain unrelated to the package's minimal exported SDK. The lack of an install hook does not mitigate arbitrary code execution t...
boxy-mops@35.2.9
This is concrete import-time remote code execution unrelated to the advertised component API. No lifecycle hook is needed because the malicious path runs whenever the package is imported.
boxy-rspack-optimize-sharing-runtime@35.2.9
This is an import-time staged-payload execution chain with no user-facing feature justification. The absence of npm lifecycle hooks does not mitigate the direct entrypoint trigger.
