Loading npm security reports…
Skip to main contentRemote Code Execution2026-09-29 08:10Soft block: AI-agent control surface2026-09-29 08:02Malware2026-09-29 07:53Soft block: AI-agent control surface2026-09-29 07:39
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 58
Updated 9 Oct 2026, 23:23 UTC. Ordered by latest scan.
items-validator@1.0.5
The import-time daemon and remote Function execution form an active remote-code-execution path. The cryptographic check authenticates the operator payload rather than constraining its cap...
@lijuneleven/iris@0.2.124
An npm post-install hook automatically executes opaque native code to install AI-agent hooks. This is an unconsented install-time mutation of a foreign AI-agent control surface.
jxnbdyh8wpfhcb@1.0.0
The only entry point implements an obfuscated, remotely controlled redirect chain whose target is encrypted until runtime. That concealed active behavior is malicious.
ccclub@0.9.7
The automatic post-install mutation of Claude Code hooks is an unconsented modification of a broad AI-agent control surface. This meets the install-control-surface block policy.