npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 639
Updated 27 Oct 2026, 05:53 UTC. Ordered by latest scan.
This is a concrete install-time remote code execution chain, not required by the documented monitoring functionality. The benign runtime implementation does not mitigate the postinstall l...
Direct inspection confirms a postinstall hook that mutates foreign AI-agent control surfaces, matching the publish-block boundary. Obfuscation and unrelated dependency rewriting increase...
Direct source inspection confirms unconsented postinstall mutation of multiple foreign AI-agent instruction files, with instructions designed to redirect and constrain agent behavior. Thi...
Source inspection confirms a postinstall hook writes a persistent global Claude Code instruction file. The guards and opt-out do not establish user consent for this broad control-surface...
This is concrete, unconsented install-time mutation of a foreign AI-agent control surface, not an explicit user-command setup. The silent policy injects package-controlled tool preference...
Source inspection confirms the critical behavior directly in the lifecycle hook; scanner similarity labels were not relied upon. This meets the firewall block policy for unconsented posti...
Source inspection confirms an install-time, user-wide Claude Code control-surface mutation, not merely suspicious primitives. This meets the blocking policy regardless of the lack of a co...
This is concrete, unconsented postinstall mutation of a foreign and broad AI-agent control surface, followed by persistent execution over future Claude Code events. That meets the blockin...
Source inspection confirms the concrete install-time Claude Code control-surface mutation required for blocking. The scanner’s credential-exfiltration label is not independently confirmed...
This is a concrete, conditional postinstall mutation of broad foreign AI-agent control surfaces, not merely an explicit user-invoked installer. The hooks cover sensitive agent events and...
Source inspection confirms the lifecycle script persistently wires package-controlled code into Claude Code's global configuration and hooks. This meets the firewall block policy for post...
The lifecycle path establishes persistent, user-wide Claude Code execution and instruction control without an explicit setup command. This meets the blocking policy regardless of otherwis...
This is concrete, unconsented postinstall mutation of broad foreign AI-agent configuration and lifecycle controls. It meets the firewall block boundary despite no observed exfiltration.
This is concrete unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. The unrelated scanner exfiltration claims were not confirmed as a...
This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. The interactive cloud setup does not mitigate that install-time behavior.
Source directly establishes a broad Claude Code hook/MCP persistence chain from npm postinstall. This meets the install-control-surface block boundary even without confirmed exfiltration.
This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The source directly establishes persistence and execution triggers rather than merely exposing a...
The install-time source contains a concrete credential-exfiltration chain; the advertised arithmetic functionality does not justify it.
Concrete silent transmission of account metadata to an unrelated logging endpoint establishes unconsented data exfiltration. The install hook itself is benign, but does not mitigate the r...
This package has concrete import-time payload staging and execution behavior, not array utility functionality. Obfuscation and hidden execution establish a malicious remote-code-execution...
The package has no declared functionality beyond an automatic preinstall script that covertly sends local host metadata over DNS. This is concrete, unconsented install-time data exfiltrat...
Concrete obfuscated metadata collection and DNS exfiltration execute automatically at install and import. This is unrelated to the package’s stated utility/descriptors purpose.
Source confirms a credential-bearing endpoint redirection, not merely a benign setup helper. The lack of an install hook does not remove the concrete credential-exfiltration chain trigger...
The concealed outbound request, silent failure handling, and complete mismatch with the package name establish a concrete data-exfiltration capability. There is no install hook, but runti...
The source implements a concrete credential-routing configuration change, not a normal Anthropic setup. The absent manifest entrypoint limits activation but does not make the source behav...