npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 619
Updated 26 Oct 2026, 17:36 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...
OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...
OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...
OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...
OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...
OpenSSF/OSV malware advisory MAL-2026-7008 blocks this version. chai-as-const@1.4.5 is a disguised dropper. The package name is unrelated to its code, which impersonates the `pino` logger...
OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...
OpenSSF/OSV malware advisory MAL-2026-10761 blocks this version. The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold (src/edit.js, src/save.js, block.json), b...
Source establishes automatic, remote transmission of user content and local operational data after MCP startup. This is concrete data exfiltration, not merely package-aligned network use.
This is concrete, unconsented install-time execution of an obfuscated credential-stealing payload; the Bun bootstrap is used to ensure it runs. The legitimate-looking CI orb content does...
This behavior is unrelated to a Babel preset and is activated automatically at install time. The clear launcher-to-obfuscated-payload chain establishes concrete malicious behavior.
Direct inspection confirms an install-time bootstrapper executing an obfuscated credential-oriented remote payload. This is concrete malicious supply-chain behavior, not a legitimate conf...
Source inspection confirms an automatic preinstall chain into an obfuscated payload with credential-oriented logic and remote eval. This is concrete malicious behavior, not a benign build...
The shipped, startup-seeded token-harvesting skill is concrete credential-capture behavior, not a benign network primitive. Lack of automatic invocation reduces reach but does not remove...
The advertised plugin is benign, but the preinstall bootstrap and obfuscated second stage establish concrete malicious install-time behavior.
This is a concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the firewall block boundary. The nominal optimization purpose and opt-in harves...
Source confirms credential harvesting from third-party application stores, automatic reachability from the main apply path, persistence, and use in gateway-routed traffic. The absence of...
Concrete install-time execution leads to an obfuscated payload with credential collection and upload behavior. The benign example sources do not justify this installer chain.
Source inspection confirms a concrete install-time bootstrapper for an obfuscated credential-harvesting/exfiltration payload. This is malicious behavior, not a package-aligned build depen...
The source confirms a concrete install-time global OpenCode takeover and shell persistence chain. The interactive prompt does not remove the unconsented postinstall mutation risk.
Direct source inspection confirms an install-time staged execution chain and obfuscated remote-code-evaluation behavior. This is concrete malicious behavior, not a normal SDK dependency s...
Direct source inspection confirms a concealed preinstall payload with remote eval and credential-oriented logic. The ordinary SDK bundle does not justify this install-time behavior.
This is not package-aligned SDK behavior: a preinstall bootstrap executes a concealed payload with remote eval and credential-oriented code. The concrete install-time execution chain warr...
Concrete preinstall execution of an obfuscated remote-code payload with credential-harvesting logic establishes malicious behavior. The normal-looking SDK bundle does not mitigate the ins...
This is concrete, unconsented preinstall execution of an obfuscated credential-harvesting payload, not functionality aligned with a React web SDK.