Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-28 09:25Soft block: AI-agent control surface2026-09-28 09:15Credential Exfiltration2026-09-28 08:39Remote Code Execution2026-09-28 08:39
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 61
Updated 10 Oct 2026, 01:48 UTC. Ordered by latest scan.
@telora/mcp-products@0.22.157
The automatic postinstall hook mutates a foreign, broad AI-agent control surface by installing command hooks. This meets the install-control-surface block policy.
@einsia/agent-git@0.2.1
An automatic postinstall invokes opaque setup that targets multiple AI-agent configuration surfaces. This is concrete unconsented install-time agent control-surface mutation.
@zubriq/code@0.22.3-7
The package creates a concrete default path from an existing OpenAI credential to a ZubrIQ endpoint and sends that credential in an Authorization header. This is credential exfiltration b...
items-validator@1.0.4
The package contains an import-triggered, detached remote payload loader that executes server-authorized JavaScript. This is concrete remote code execution, not ordinary item validation.
