npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 653
Updated 27 Oct 2026, 13:35 UTC. Ordered by latest scan.
Direct source inspection confirms an install-time host-fingerprinting exfiltration chain. The declared dependency-confusion proof-of-concept description reinforces malicious intent.
Direct source inspection confirms unconsented install-time host-data exfiltration. The nested archive contains the same manifest and script.
This is concrete, unconsented install-time host-data exfiltration, corroborated directly in the manifest and source.
Source directly confirms unconsented install-time collection and exfiltration of host-identifying data. This is concrete malicious behavior, not a benign package-aligned network action.
Direct source inspection confirms unconsented install-time exfiltration and remote-access persistence. This is concrete malicious behavior, not a package-aligned feature.
Source inspection confirms concrete payment-related data exfiltration to hardcoded external webhook credentials. Lack of lifecycle hooks does not mitigate the runtime disclosure path.
The lifecycle hook establishes persistent, package-controlled global agent commands without an explicit user command. This meets the install-time AI-agent control-hijack blocking boundary.
The package has concrete unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. This meets the blocking policy despite benign validation and explicit deploy-ke...
Direct inspection confirms a postinstall hook writes package-supplied AI-agent commands into the user-level OpenCode command directory. This meets the blocking policy for unconsented life...
Direct source inspection confirms the lifecycle hook force-installs agent instructions outside the package directory. This meets the blocking policy for unconsented postinstall mutation o...
Source inspection confirms the lifecycle hook creates a persistent global OpenCode prompt channel and overwrites command names. Scanner claims of encrypted temporary payload execution and...
Source inspection confirms the concrete install-time OpenCode control-surface mutation required for blocking. Scanner claims of encrypted payload execution were not corroborated, but are...
OpenSSF/OSV malware advisory MAL-2026-11066 blocks this version. On npm install, the package's preinstall lifecycle script (preinstall.js) reads a hex-encoded command string from preinsta...
Direct source inspection confirms deliberate credential exfiltration on the exported runtime path. The lack of lifecycle scripts limits automatic execution but does not remove the concret...
Direct source inspection confirms the lifecycle hook performs forced user-level OpenCode command injection. This meets the firewall block policy regardless of the scanner's unrelated bund...
Source inspection confirms concrete postinstall mutation of host and user AI-agent configuration, exceeding a normal dependency install boundary. This meets the firewall policy for a publ...
This is unconsented install-time mutation of broad third-party AI-agent control surfaces, coupled to remote executable delivery and persistence. The skips and uninstall behavior do not re...
The package performs unconsented postinstall mutation of a global AI-agent command surface, not merely package-local setup. The lack of observed install-time exfiltration does not remove...
The package has a concrete unconsented postinstall path that mutates a broad AI-agent control surface. Under the install-control-surface policy, this requires blocking regardless of the b...
The lifecycle hook performs broad AI-agent skill installation automatically rather than through an explicit user command. This meets the blocking policy for unconsented postinstall mutati...
Direct source inspection confirms the policy-defined blocking behavior, independent of scanner labels. The bundled payload appears product-aligned, but its unconsented broad postinstall d...
Source inspection confirms the scanner’s lifecycle concern: this is not inert code or an explicit user command. The automatic broad agent-host skill installation meets the firewall block...
This is a concrete unconsented postinstall mutation of a broad foreign AI-agent control surface. The benign-looking skill content does not remove that install-time control-surface risk.
Source confirms unconsented postinstall mutation of foreign/broad AI-agent configuration via a remotely resolved npx installer. This meets the install-control-surface block boundary.
The source directly implements the policy's blocking condition: postinstall mutation of foreign/broad AI-agent configuration via a global all-agent installer. Scanner findings about fonts...