Loading npm security reports…
Skip to main contentCredential Exfiltration2026-09-14 06:27Soft block: AI-agent control surface2026-09-14 06:27Remote Code Execution2026-09-14 06:21Remote Code Execution2026-09-14 06:20
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 63
Updated 10 Oct 2026, 04:33 UTC. Ordered by latest scan.
@clawos-dev/clawd@0.2.506
This is a concrete credential-collection and transmission chain to a hard-coded raw-IP endpoint with TLS verification disabled. The lack of an npm lifecycle hook limits installation risk...
devez-vibe@1.9.2
This package performs automatic postinstall mutation of foreign AI-agent control surfaces and installs additional user-level dependencies. That meets the install-hook abuse blocking crite...
@funny-booth/agent-core@0.1.13
This is a concrete remote payload-execution chain that forwards sensitive values to remotely selected code. The lack of an install hook does not mitigate the explicit runtime attack surface.
noblox-asset.js@7.6.0
The declared runtime entrypoint directly invokes an obfuscated remote-binary downloader and process launcher. The absence of a lifecycle script limits the install-time trigger but does no...
