npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 649
Updated 27 Oct 2026, 11:35 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-11107 blocks this version. Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install an...
OpenSSF/OSV malware advisory MAL-2026-11108 blocks this version. The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipelin...
This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, including destructive replacement of existing paths. It meets the blocking policy regardle...
The package performs concrete, unconsented postinstall mutation of multiple broad AI-agent control surfaces. This meets the firewall block policy even though no install-time exfiltration...
This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, meeting the firewall block policy despite no confirmed data exfiltration.
The automatic postinstall crosses multiple unrelated AI-host configuration domains and persists package-controlled agent behavior. This meets the install-control-surface block boundary ev...
This is a concrete unconsented install-time mutation of foreign global AI-agent configuration, not merely a user-invoked CLI feature. No separate credential-exfiltration chain was confirmed.
This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces. The absence of lifecycle exfiltration does not neutralize the persistence and permission...
Direct source inspection confirms an import-time remote payload fetch followed by eval with no validation. This is a concrete remote-code-execution chain, not merely a static hint.
Source inspection confirms an import-time remote-payload loader with dynamic execution. This is a concrete arbitrary-code-execution chain, not merely a static hint.
OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...
OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...
OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...
OpenSSF/OSV malware advisory MAL-2026-11099 blocks this version. The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoPa...
OpenSSF/OSV malware advisory MAL-2026-2785 blocks this version. On `npm install`, the package's `preinstall` hook executes `index.js`, which collects host identifiers (os.hostname(), os.p...
OpenSSF/OSV malware advisory MAL-2026-2785 blocks this version. On `npm install`, the package's `preinstall` hook executes `index.js`, which collects host identifiers (os.hostname(), os.p...
OpenSSF/OSV malware advisory MAL-2025-190499 blocks this version. The package filifecycleserv-paypal was found to contain malicious code.
Concrete import-time remote payload execution and persistence behavior is present in the package's default entrypoint. The benign helper functions and store do not mitigate this attack ch...
The import-time obfuscated installer creates a concrete remote-payload and persistence chain. Absence of an npm lifecycle hook does not mitigate execution when consumers import the defaul...
This is unconsented install-time collection and DNS exfiltration of host data, not a package-aligned setup action. The concrete lifecycle-triggered network behavior warrants blocking.
OpenSSF/OSV malware advisory MAL-2026-11093 blocks this version. The package's postinstall lifecycle hook runs `node index.js`, which issues an HTTPS GET to a hardcoded Burp Collaborator...
Source establishes a concrete, user-data-bearing request to an unrelated endpoint during normal Android initialization. It can include IMAP credentials, making this credential exfiltratio...
Source establishes a concrete default-enabled runtime data-exfiltration path to package-embedded external webhooks. The lack of install hooks does not mitigate this application-runtime be...
Source confirms an undisclosed, automatic and detached upload path for local AI conversation content. No install-time hook is present, but runtime data exfiltration is concrete.
OpenSSF/OSV malware advisory MAL-2026-6564 blocks this version. @thone33/core-utils 1.0.4 is a loader stub. Its main entry (index.js) imports `activate` from the same-author dependency `@...