Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-29 01:38Soft block: AI-agent control surface2026-09-29 01:37Install Hook Abuse2026-09-29 01:27Soft block: AI-agent control surface2026-09-29 01:22
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 59
Updated 10 Oct 2026, 00:10 UTC. Ordered by latest scan.
@telora/mcp-products@0.22.168
The automatic lifecycle mutation of a foreign, user-wide AI-agent control surface meets the blocking policy. The script is conditional on executables being present, but no consent gate li...
@vaibot/codex-circuitbreaker-plugin@1.3.2
The automatic lifecycle hook mutates global Codex agent configuration and registers a remote MCP service. This meets the blocking policy for unconsented postinstall control-surface mutation.
@jenga-ai/agent@4.1.0
The automatic post-install chain mutates foreign AI-agent configuration and installs executable lifecycle hooks without interactive consent. This is concrete install-hook abuse under the...
@buzzni/happy-cli@1.1.10-aplus.260
The automatic post-installation of external AI authentication tooling into the global environment is a concrete unconsented lifecycle mutation. The environment gates limit scope but do no...
