npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 643
Updated 27 Oct 2026, 08:14 UTC. Ordered by latest scan.
The behavior is directly reachable from postinstall and writes broad agent instruction surfaces after a remote fetch. Explicit setup paths do not mitigate the automatic lifecycle trigger.
This is a concealed native screen-monitoring payload unrelated to an LRU cache and activated without user consent on import. The source launcher makes the binary's remote capability direc...
This is a concrete, automatic credential and account-data exfiltration path, not merely a suspicious primitive. The install hook itself is benign, but runtime behavior warrants blocking t...
This is concrete import-time staged remote code execution, not a package-aligned feature. The absence of lifecycle hooks does not mitigate the reachable malicious entrypoint.
This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, followed by package-supplied instructions that can solicit credentials and transfer project arti...
The lifecycle hook performs concrete, persistent AI-agent instruction-file mutation outside the package directory. Absence of exfiltration does not remove this install-time control-surfac...
OpenSSF/OSV malware advisory MAL-2026-11160 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-11161 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...
OpenSSF/OSV malware advisory MAL-2026-11158 blocks this version. package.json declares preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpo...
OpenSSF/OSV malware advisory MAL-2026-11159 blocks this version. package.json defines both preinstall and postinstall lifecycle scripts that run curl against a hardcoded webhook.site endp...
OpenSSF/OSV malware advisory MAL-2026-11157 blocks this version. The OpenSSF Package Analysis project identified '@mypwn/hawkeye' @ 99.0.0 (npm) as malicious.
Source inspection confirms concrete postinstall takeover of a consumer repository’s CLAUDE.md and persistence-oriented ignore-file mutation. This meets the blocking policy for unconsented...
The install-time global Claude Code configuration write meets the blocking policy regardless of the statusline's presently benign behavior. No credential exfiltration was found in the ins...
Source inspection confirms an unconsented postinstall mutation of both Claude and Codex user MCP configurations. This meets the firewall block policy regardless of the package's stated or...
The package has a concrete credential-exfiltration path and runtime mutation of a foreign AI-agent control surface. Its harmless postinstall does not mitigate those activated runtime beha...
Direct source inspection confirms unconsented postinstall mutation of foreign, broad AI-agent skill locations and package-controlled instructions that act on injected work. This meets the...
Concrete install-time host/user metadata exfiltration is present in source and is unrelated to the package's advertised utility. This warrants blocking publication.
The automatic external transmission of account configuration, including potentially credentials, is concrete malicious behavior. Benign workspace linking at install does not mitigate that...
This is an import-time, concealed remote payload path unrelated to the advertised UUID API. Its current README-dependent guard does not neutralize the Windows remote-code-execution behavior.
Direct source inspection confirms an install-time shell command that collects and exfiltrates host/user identifiers to a third party. The runtime utility entrypoint does not justify this...
Source inspection confirms an automatic postinstall write into pre-existing third-party AI-agent skill directories. Under the install-control-surface policy, this is a concrete blocking c...
Source confirms automatic remote logging of an object type that includes email credentials. The benign postinstall script does not mitigate this concrete exfiltration path.
OpenSSF/OSV malware advisory MAL-2026-10981 blocks this version. index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODE_ENV!= 'p...
OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...
OpenSSF/OSV malware advisory MAL-2026-11133 blocks this version. The published tarball's dist bundles (dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js) execute a...