npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 633
Updated 27 Oct 2026, 02:11 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11456 blocks this version. The package's postinstall hook invokes lib/report.js, which harvests the developer's email (queried via `gh api user/email...
OpenSSF/OSV malware advisory MAL-2026-11455 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-11454 blocks this version. The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/G...
OpenSSF/OSV malware advisory MAL-2026-11453 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-11454 blocks this version. The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/G...
OpenSSF/OSV malware advisory MAL-2026-11434 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-11430 blocks this version. npm package list-issue-predecessor-dependencies-block@99.0.0 auto-executes index.js from three lifecycle hooks (preinstall...
The concrete postinstall behavior is unconsented mutation of foreign global AI-agent control surfaces. This meets the firewall block boundary despite the package-aligned generated content.
Direct inspection confirms the lifecycle payload performs the control-surface writes; README disclosure does not make the npm postinstall consensual. No separate exfiltration chain was fo...
The package implements a concrete, unconsented postinstall mutation chain across third-party AI-agent configurations. Its normal provider networking is secondary and user-configured.
The install hook performs a concrete, unconsented global mutation of foreign/broad AI-agent skill surfaces. No separate credential theft or unrelated network exfiltration was found, but t...
This is concrete, unconsented postinstall mutation of a foreign AI-agent control surface, meeting the block policy. The absence of install-time exfiltration does not remove the launcher-h...
The package implements an unconsented import-time remote binary loader and executor unrelated to its documented Operations SDK API. This is concrete malicious behavior, not merely telemetry.
Direct source inspection confirms an import-time staged payload downloader and executor unrelated to the declared minimal package API. Absence of lifecycle hooks does not mitigate the rea...
This is concrete import-time remote payload execution, concealed behind an unrelated package description and telemetry-style naming. No lifecycle hook is needed because ordinary package i...
This is a concrete import-time remote code execution chain unrelated to the stated forms interface, with obfuscated endpoints and no payload validation.
The behavior is explicit rather than stealthy, but it is still an unconsented postinstall remote-code bootstrap with broad host mutation and no content pinning or verification. This meets...
Source confirms reachable, automatic reporting to hardcoded third-party Telegram recipients during normal CLI use. This is concrete unauthorized data exfiltration, not merely a noisy netw...
This is concrete import-time remote code execution, not package-aligned telemetry: opaque binaries are remotely staged and launched without validation. The absence of lifecycle hooks does...
This is concrete import-time staged payload execution with no legitimate relationship to the declared datetime library. Lack of lifecycle hooks does not reduce the direct require-time exe...
The preinstall hook is benign, but normal runtime behavior contains a concealed, remote-controlled account-state mutation unrelated to a WhatsApp API library's requested operation.
Source establishes an automatic, remote-controlled action on the user's WhatsApp account after normal runtime connection. The install hook is benign, but it does not mitigate this concret...
The package contains a concrete, covert, remote-controlled mutation of the user's WhatsApp account at normal runtime. This is not required by the documented connection flow and is distinc...
Source confirms automatic third-party telemetry containing account data and serialized IMAP settings, including password fields. The benign workspace-only postinstall hook does not mitiga...
The package has a normal-looking PostCSS facade, but its import-time appended payload is an explicit remote loader and executor. The behavior is unrelated to the declared CSS transformati...