npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 626
Updated 26 Oct 2026, 21:58 UTC. Ordered by latest scan.
The preinstall hook deliberately bootstraps and executes an unrelated obfuscated payload, including remote code evaluation and credential-related logic. This is concrete malicious install...
This is a concrete remote code-execution primitive, despite being gated behind an explicitly enabled debug plugin. No install-time behavior was found.
This is concrete postinstall mutation of several foreign/global AI-agent control surfaces, meeting the blocking policy. The additional daemon autostart increases persistence risk.
This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the publish-block policy. The skip flags and lack of lifecycle networking do not...
This is concrete, covert runtime abuse of an authenticated third-party service, not a normal package-aligned network operation. No install hook is required because it activates during ord...
OpenSSF/OSV malware advisory MAL-2026-11518 blocks this version. Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and pos...
Direct source inspection confirms an install-time rewrite of a foreign AI coding-agent package and UI dependency. This meets the blocking policy regardless of the package's stated brandin...
The confirmed lifecycle script performs broad writes into a foreign AI-agent SDK, including persistent configuration takeover. Package-aligned runtime channel and workflow features do not...
The lifecycle script directly executes a Windows binary whose embedded .NET metadata describes multiple concrete malware capabilities. No legitimate package functionality is present to ju...
The source establishes a concrete, default-on data-exfiltration path for personal and repository metadata, with no effective first-run disclosure. The install hook's conditional first-par...
The package contains concrete, undisclosed default-on exfiltration of sensitive local and project metadata during normal CLI use. The conditional postinstall workflow setup is not the blo...
Source inspection confirms the lifecycle mutation rather than relying on scanner labels. It meets the blocking policy for unconsented postinstall mutation of a foreign/broad AI-agent cont...
The package performs unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. This meets the install-control-surface block boundary regardless of the benign-look...
This is concrete, undisclosed credential exfiltration plus remote consumption of a user's Claude capacity, triggered by normal CLI use. The lack of install hooks does not mitigate the run...
OpenSSF/OSV malware advisory MAL-2026-11515 blocks this version. Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project (author field set to 'bitcoinjs', repo URL pointi...
The lifecycle script installs an opaque native payload and intentionally evades platform trust controls without an explicit user command. Hash pinning limits transit tampering but does no...
This is concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces. It meets the firewall block policy even though no separate exfiltration chain was found.
Automatic execution of an unverified, remotely supplied shell payload is a concrete install-time remote-code-execution chain. Runtime API and media-tool execution do not mitigate that ins...
This is a concrete, unconsented postinstall mutation of a foreign broad AI-agent control surface. The documented product purpose does not remove the install-time control-surface impact.
Source inspection confirms a concrete postinstall chain that modifies consumer .npmrc and multiple AI-agent configuration surfaces. This meets the policy boundary for an unconsented insta...
The package performs default-enabled, recurring export of sensitive AI-workflow and repository metadata to a hard-coded external endpoint, rather than requiring user configuration. This i...
The package's stated integration purpose does not justify its unconsented postinstall mutation of a foreign global AI-agent control surface. This meets the firewall block criterion even t...
The package contains concealed, automatic account mutations and a remotely controlled target list, unrelated to normal WhatsApp client operation. Its lifecycle hook is benign, but the run...
This is a concrete unconsented postinstall mutation of broad/foreign AI-agent control surfaces, compounded by unchecked remote binary staging. The absence of observed exfiltration does no...
The import-time, unauthenticated remote-binary execution chain is concrete and unrelated to a settings/config package. The unused-looking telemetry module duplicates the same downloader/e...