npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 651
Updated 27 Oct 2026, 12:30 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-5552 blocks this version. On `npm install`, the package's `postinstall` runs `scripts/inject.js`, which walks up from the current working directory t...
OpenSSF/OSV malware advisory MAL-2026-5551 blocks this version. On `npm install`, the package's postinstall script (scripts/inject.js) locates the consumer project's main Express entry fi...
OpenSSF/OSV malware advisory MAL-2026-5550 blocks this version. On `npm install`, the package's postinstall hook (`scripts/inject.js`) locates the installer's host project root, identifie...
Source directly implements unconsented install-time collection and exfiltration of local system data. This is concrete malicious behavior, not a package-aligned feature.
This is a concrete, undisclosed import-time remote code execution chain unrelated to a UUID package. The absence of lifecycle hooks does not mitigate the automatic runtime trigger.
Direct source inspection confirms raw credential exfiltration to a package-author-controlled endpoint. The lack of an install hook limits automatic reachability but does not remove the co...
Source directly establishes an automatic import-time remote payload download and execution chain. This is concrete malicious behavior, independent of scanner labels.
Direct source inspection confirms a concrete credential-exfiltration path in the Android runtime. The lifecycle script itself is not the attack vector.
The source implements unconsented transmission of mail-account configuration, including potential IMAP credentials, to a third-party logging host. This is concrete credential exfiltration...
Source confirms concrete remote exfiltration of clipboard data and screenshots, activated by the package’s advertised executable. Absence of an install hook does not remove the malicious...
The package contains a concrete automatic data-exfiltration path to an unrelated host, including a path that can send IMAP credentials. This outweighs the otherwise mail-aligned network b...
The documented package is calendar/streak math, but its primary entry contains a concealed import-time downloader, detached executable launch, and persistence mechanism. The environment g...
The package explicitly transmits a consumer credential to a hard-coded developer endpoint during normal use. Lack of an install hook does not mitigate this concrete credential-exfiltratio...
OpenSSF/OSV malware advisory MAL-2026-11072 blocks this version. The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path (via __filename with se...
OpenSSF/OSV malware advisory MAL-2026-11071 blocks this version. whs4_eud@1.0.1 declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On e...
OpenSSF/OSV malware advisory MAL-2026-11070 blocks this version. package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's a...
OpenSSF/OSV malware advisory MAL-2026-11069 blocks this version. The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 (npm) as malicious.
OpenSSF/OSV malware advisory MAL-2026-11069 blocks this version. The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 (npm) as malicious.
This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. Lack of observed lifecycle exfiltration does not remove the...
Direct source inspection confirms unconsented postinstall mutation of a foreign AI-agent control surface, plus persistence and interception setup. This meets the blocking policy despite s...
This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, not merely a user-invoked integration. The source establishes transcript access through that ins...
This is a concrete unconsented npm postinstall mutation of broad, foreign AI-agent control surfaces. Under the stated policy, that requires a block regardless of the package-aligned servi...
The install hook concretely writes package-controlled AI-agent instructions into foreign global agent directories. This meets the blocking policy for unconsented postinstall mutation of a...
Direct inspection confirms the lifecycle script writes package-controlled instructions into existing ~/.claude and ~/.codex installations. This meets the blocking policy regardless of the...
Direct inspection confirms the postinstall drop into ~/.claude and ~/.codex, not merely scanner inference. This meets the firewall block boundary for unconsented postinstall mutation of b...