npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 641
Updated 27 Oct 2026, 07:01 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
OpenSSF/OSV malware advisory MAL-2026-11179 blocks this version. @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to ke...
The package contains a concrete concealed remote-code execution chain unrelated to its advertised scaffolding function. Absence of an install hook does not mitigate execution when its ser...
Source establishes unconsented API-key disclosure to a remote relay, not merely a risky primitive. The remote-command capability magnifies the impact.
源码确认了安装时对多个非本包拥有的 AI 工具用户配置的持久化修改，满足阻断条件。运行时还存在向默认远程 MCP 服务转发本地认证配置的具体链路。
This is concrete credential disclosure to a package-controlled relay, not merely an advertised AI-agent capability. Persistent arbitrary code loading and an opaque executable bytecode pay...
Direct source establishes unredacted API-key disclosure to a hard-coded third-party relay and remote task control. This is concrete credential-exfiltration behavior, not a scanner-only in...
The explicit daemon command is not install-time behavior, but it concretely discloses API credentials to a relay and exposes remote command execution. This exceeds a benign remote-agent c...
Source establishes credential transmission to a package-controlled relay, not merely an advertised remote-agent capability. The absence of install hooks does not mitigate this runtime exf...
This is concrete credential exfiltration to a package relay and a remotely directed command-execution path, not merely an advertised agent capability. No install hook is needed for the ha...
The credential transmission and remote-control chain are directly present in source, not inferred from scanner labels. Explicit user activation does not justify transmitting a BYOK key to...
This is concrete credential disclosure to a remote relay combined with remote host-control capability; it is not merely an inert agent toolset. No install lifecycle hook was found, but ru...
This is a concrete, concealed remote-code-execution loader, not an SVG utility feature. Lack of install hooks limits automatic activation but does not remove the malicious capability.
The lifecycle path concretely modifies broad Codex control surfaces and project hooks/configuration during installation. This meets the blocking policy even though no data-exfiltration ch...
Source inspection confirms unconsented postinstall mutation of global and project AI-agent control surfaces. This meets the firewall block boundary regardless of the absence of confirmed...
This is concrete unconsented postinstall mutation of foreign/broad AI-agent configuration, meeting the blocking policy even though no direct credential exfiltration was observed.
Source inspection confirms the lifecycle hook performs unconsented, broad AI-agent configuration and hook mutations. This meets the install-control-surface block boundary even though no s...
Source inspection confirms unconsented postinstall mutation of a broad foreign AI-agent control surface. This meets the install-control-surface blocking rule.
This is a concrete unconsented postinstall AI-agent control-surface mutation, meeting the block boundary. Lack of a confirmed exfiltration endpoint does not mitigate the persistent hook/c...