npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 648
Updated 27 Oct 2026, 11:00 UTC. Ordered by latest scan.
Source inspection confirms concrete, obfuscated third-party license/beacon and overlay injection into consumer build artifacts, unrelated to the declared SVG utility. No lifecycle hook is...
This is a concrete unverified remote payload chain activated by npm postinstall, not merely a normal packaged optional dependency. The fixed IP endpoint and disabled TLS validation make t...
The malicious behavior is directly reachable at install time and has no package-related purpose. It combines host/credential-context collection, metadata probing, and external exfiltration.
Direct source inspection confirms concrete install-time data collection and exfiltration. The benign main entrypoint does not mitigate the malicious lifecycle behavior.
This is concrete, automatic install-time data exfiltration unrelated to the package's advertised utility functions. The benign index entrypoint does not mitigate the malicious lifecycle p...
OpenSSF/OSV malware advisory MAL-2026-11110 blocks this version. The npm package `@wagni_bot/eth` is a supply-chain credential stealer disguised as a **Ethereum** SDK. It is one member of...
OpenSSF/OSV malware advisory MAL-2026-11114 blocks this version. The npm package `@wagni_bot/polygon` is a supply-chain credential stealer disguised as a **Polygon** SDK. It is one member...
OpenSSF/OSV malware advisory MAL-2026-11115 blocks this version. The npm package `@wagni_bot/polymarket` is a supply-chain credential stealer disguised as a **Polymarket** SDK. It is one...
OpenSSF/OSV malware advisory MAL-2026-11113 blocks this version. The npm package `@wagni_bot/opensea` is a supply-chain credential stealer disguised as a **OpenSea** SDK. It is one member...
OpenSSF/OSV malware advisory MAL-2026-11112 blocks this version. The npm package `@wagni_bot/metamask` is a supply-chain credential stealer disguised as a **MetaMask** SDK. It is one memb...
OpenSSF/OSV malware advisory MAL-2026-11111 blocks this version. The npm package `@wagni_bot/hyperliquid` is a supply-chain credential stealer disguised as a **Hyperliquid** SDK. It is on...
OpenSSF/OSV malware advisory MAL-2026-11109 blocks this version. The npm package `@wagni_bot/bsc` is a supply-chain credential stealer disguised as a **BNB Smart Chain (BSC)** SDK. It is...
OpenSSF/OSV malware advisory MAL-2026-11117 blocks this version. The npm package `@wagni_bot/web3` is a supply-chain credential stealer disguised as a **web3.js** SDK. It is one member of...
OpenSSF/OSV malware advisory MAL-2026-11116 blocks this version. The npm package `@wagni_bot/wagni` is a supply-chain credential stealer disguised as a **the campaign's own namesake handl...
Direct source inspection confirms automatic remote transmission of sensitive account configuration to an unrelated logging endpoint. This is a concrete credential-exfiltration path, not m...
Source establishes a direct runtime path from configured IMAP passwords to a third-party logging endpoint. The lack of install hooks does not mitigate this concrete credential-exfiltratio...
This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. The inspected lifecycle code also permits remote instructi...
OpenSSF/OSV malware advisory MAL-2026-11106 blocks this version. The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install a...
OpenSSF/OSV malware advisory MAL-2026-11107 blocks this version. Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install an...
OpenSSF/OSV malware advisory MAL-2026-11108 blocks this version. The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipelin...
This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, including destructive replacement of existing paths. It meets the blocking policy regardle...
The package performs concrete, unconsented postinstall mutation of multiple broad AI-agent control surfaces. This meets the firewall block policy even though no install-time exfiltration...
This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, meeting the firewall block policy despite no confirmed data exfiltration.
The automatic postinstall crosses multiple unrelated AI-host configuration domains and persists package-controlled agent behavior. This meets the install-control-surface block boundary ev...
This is a concrete unconsented install-time mutation of foreign global AI-agent configuration, not merely a user-invoked CLI feature. No separate credential-exfiltration chain was confirmed.