npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 638
Updated 27 Oct 2026, 05:18 UTC. Ordered by latest scan.
The package has an unconsented postinstall that collects system/user data and mutates the filesystem, explicitly presented as dependency-confusion proof behavior. No exfiltration endpoint...
Direct source inspection confirms a concrete credential-exfiltration path to an unrelated default endpoint during normal runtime recovery. No install hook is needed for the harmful behavior.
Direct source inspection confirms an automatic external logging channel that captures sensitive mail-client diagnostics; the lifecycle hook itself is not the malicious behavior.
The package performs confirmed, unprompted recursive user-data deletion at install time. Its LAN sync and Electron-launch behavior do not establish exfiltration, but do not mitigate the d...
Source inspection confirms an unconsented install-time destructive action against the package's stored credential data. No exfiltration was found, but the automatic vault deletion warrant...
The lifecycle hook creates and configures a consumer project's Claude Code control surface automatically. Under the install-control-surface policy, this concrete behavior requires blockin...
OpenSSF/OSV malware advisory MAL-2026-11204 blocks this version. Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced...
OpenSSF/OSV malware advisory MAL-2026-11205 blocks this version. The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author...
OpenSSF/OSV malware advisory MAL-2026-10693 blocks this version. The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarv...
OpenSSF/OSV malware advisory MAL-2026-11203 blocks this version. The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream r...
The package's sole runtime behavior is unvalidated remote-code retrieval and eval at import time. This is a concrete remote code execution chain, not merely a suspicious primitive.
The package performs an unconsented postinstall mutation of a foreign AI-agent control surface. This meets the firewall block boundary even though the separately provided hook workflow is...
This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, coupled with remote payload download and execution. The restrictive guards do not provide user con...
The package contains an unconsented install-time and import-time concealed arbitrary-code execution chain. The blockchain library functionality does not justify this detached decrypted pa...
Source establishes an active runtime path from account configuration to an external endpoint, including possible credentials. The benign workspace-only postinstall hook does not mitigate...
This is a concrete credential-exfiltration path in shipped runtime code, not merely a suspicious primitive. The install hook itself is benign, but does not mitigate the runtime behavior.
The package contains a concrete, runtime credential-exfiltration path to an unrelated logging endpoint. It is not required for mail synchronization and has no user-consent gate.
Source directly establishes a runtime credential-exfiltration path to rmf39.aaz.lt. The lack of install hooks does not mitigate this user-runtime attack.
The package is a minimal carrier for an unauditable remote dependency that automatically executes installation code. Static exports are benign but do not mitigate the install-time executi...
This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit setup command. The forced rules redirect agent behavior to a downlo...
This is a concrete remote-code-execution backdoor pattern, not merely normal CLI process launching. Lack of an install hook limits automatic exposure but does not remove the dangerous rea...
Source inspection confirms the critical behavior directly: postinstall overwrites global Claude/Codex skill entries rather than requiring an explicit setup command. This meets the firewal...
OpenSSF/OSV malware advisory MAL-2026-11196 blocks this version. The package's preinstall lifecycle script runs automatically on `npm install`. It reads the installer's username (from USE...
This is concrete unconsented postinstall mutation of a broad foreign AI-agent control surface, meeting the blocking policy. The documented manual workflow and opt-out do not make the defa...
This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. No network or credential-exfiltration chain was found, but i...