npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 642
Updated 27 Oct 2026, 07:38 UTC. Ordered by latest scan.
The package’s automatic install-time modification of global/project Codex configuration and lifecycle hooks meets the blocking policy for foreign broad AI-agent control-surface mutation....
The lifecycle code implements concrete, default-on mutation of foreign/broad Codex configuration and extensions. Guardrails and opt-outs do not make the install-time action consented.
Direct inspection confirms the policy-defined block condition: postinstall performs unconsented mutation of foreign/broad Codex control surfaces. Guardrails and backups do not remove the...
Source inspection confirms the lifecycle hook performs broad Codex and project-control-surface mutations by default. This meets the firewall block boundary for unconsented postinstall AI-...
Direct source inspection confirms unconsented postinstall writes to global Codex and agent configuration, including auth-related files and MCP setup. This meets the firewall block policy...
Source inspection confirms a concrete credential-exfiltration and remote-command-control chain, not merely a bytecode or network heuristic. The explicit runtime trigger does not remove th...
Source inspection confirms a concrete, unconsented postinstall mutation of broad AI-agent control files, sourced from a remote mutable archive. This meets the blocking policy.
The source establishes an unconditional import-time remote-code-execution chain. It has no package-aligned functional safeguard or integrity validation.
The lifecycle hook concretely mutates a foreign AI-agent implementation during installation. Its narrow, version-checked patch does not remove the unconsented cross-package control-surfac...
The lifecycle hook establishes and enables agent extensions across unrelated tools at install time, including unconditional Claude mutation and Codex config changes. This meets the instal...
This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The absence of network exfiltration does not remove the install-time control-surface abuse.
Source inspection confirms unconsented install-time persistence across multiple third-party AI-agent configurations, meeting the block policy despite no confirmed install-time exfiltration.
The source confirms unconsented postinstall mutation of the consuming project's shared AI-agent instruction file. Under the firewall policy this concrete control-surface write requires bl...
The concealed remote payload loader is concrete arbitrary code execution, not required for the documented SVG functionality. Absence of install hooks limits automatic activation but does...
This is concrete, unconsented install-time mutation of broad foreign AI-agent control surfaces, meeting the blocking policy. The absence of install-time networking does not mitigate the p...
The automatic, concealed runtime installation and execution of an unrelated dependency is concrete malicious behavior, not required for a Rollup polyfill plugin. No lifecycle hook is need...
Source confirms a default runtime path that forwards rich application logs to package-embedded external receivers. The absence of install hooks reduces installation risk but does not remo...
Direct source inspection confirms an install-time cross-agent control-surface mutation and a runtime silent-upgrade path that repeats it. This meets the blocking policy regardless of the...
This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces. Under the firewall policy it warrants blocking even without observed exfiltration.
This is concrete, automatic exfiltration of conversation content after required login, not merely a user-invoked sync feature. The package's documented opt-in and privacy claims conflict...
This is concrete install-time mutation of a foreign, broad AI-agent control surface. The installed wildcard handler has authority to deny Claude tool calls.
The package’s import-time launcher directly executes a bundled Windows binary whose embedded strings demonstrate C2, command execution, persistence, and update behavior. This is concrete...
This is not a benign native dependency: importing the package launches a bundled C2-capable PowerShell agent that persists on the host. The absence of an install hook does not mitigate th...
The package uses an import-time side effect to execute a bundled Windows remote-control agent. Its capture, command, persistence, and network capabilities establish concrete malicious beh...
The runtime import chain silently executes a bundled Windows binary whose static contents indicate remote command capability and persistence. The absence of an npm install hook does not m...