npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 635
Updated 27 Oct 2026, 03:12 UTC. Ordered by latest scan.
The reachable import-time loader provides a concrete arbitrary remote code execution chain, not legitimate telemetry behavior. Lack of an npm lifecycle hook does not mitigate execution on...
The package's only advertised runtime API does not require telemetry, yet its entrypoint silently fetches and executes unverified remote bytes. This is a concrete import-time remote-code-...
This is concrete import-time staged payload execution, not package-aligned telemetry. The absence of lifecycle hooks does not mitigate execution whenever consumers import the package.
The package's import-time loader provides an unauthenticated remote-code-execution chain with concealed endpoints and no legitimate API linkage. This is concrete malicious behavior, indep...
This is a concrete, automatic remote-payload execution chain unrelated to the advertised minimal forms package. Lack of install hooks does not mitigate import-time execution.
Source directly establishes import-time remote payload retrieval and execution. The package description and exposed API do not justify this behavior.
The package contains a concrete, automatically reachable remote binary download-and-execute chain unrelated to its advertised carousel interface. This is malicious remote code execution,...
This is a concrete import-time staged payload execution chain, unrelated to the advertised visual-components/circuitbreaker API. Absence of an npm lifecycle script does not mitigate runti...
The documented pub/sub package has an undeclared import-time remote payload execution chain unrelated to its stated functionality. This is concrete malicious behavior, not telemetry.
The source implements concrete download-and-execute behavior on normal package import, with obfuscated endpoints and no integrity validation. The lack of npm lifecycle hooks does not miti...
The malicious chain is concrete, import-reachable, and executes unauthenticated remote bytes; the telemetry naming does not provide a legitimate package-aligned purpose.
The package’s import path contains a concrete, stealthy remote code-execution chain unrelated to its stated GitLab-label SDK purpose. This is malicious behavior, not benign telemetry.
The postinstall path unconditionally mutates global Claude Code configuration and establishes package-controlled execution across unrelated sessions. This meets the install-control-surfac...
The package contains concrete, automatic broad AI-agent control-surface mutation and stealthy monitoring/persistence activated by ordinary CLI use. No lifecycle hook is needed for this be...
The package’s claimed rule-pack purpose does not require secret collection or external transmission. Source directly implements credential and host-data exfiltration despite lacking an in...
The package implements an unverified staged payload path culminating in dynamic code execution, not merely data-driven audit rules. Lack of an install hook limits activation to explicit C...
The package contains a real, import-time, targeted page-disruption payload rather than merely suspicious primitives. Lack of install hooks does not mitigate runtime harm to downstream bro...
OpenSSF/OSV malware advisory MAL-2026-11427 blocks this version. package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP v...
Source establishes automatic transmission of sensitive account configuration, including potentially plaintext IMAP passwords, to an external logging host. This is concrete credential/data...
The package contains a concrete runtime credential-exfiltration path, despite having no install hook. Mail/OAuth functionality does not justify forwarding serialized credentials to the ex...
Source inspection confirms unconsented outbound logging of sensitive mail-account data, including a path that may serialize passwords. Benign lifecycle and local MCP behavior do not mitig...
This is a concealed staged malware loader, not calendar parsing: it dynamically evaluates hidden code, writes a remote executable, and executes it. Absence of lifecycle hooks does not mit...
This is a concrete install-time remote payload execution chain unrelated to the declared React drawer package. Obfuscation, fallback DNS payload delivery, hidden filenames, and suppressed...
The postinstall hook concretely mutates a broad AI-agent control surface by installing remote skills. Opt-out and source-checkout guards do not make this install-time action consented.
Direct source inspection confirms a postinstall downloader/dropper/launcher chain with remote payload control. The package provides no legitimate implementation that would require executi...