npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 654
Updated 27 Oct 2026, 14:04 UTC. Ordered by latest scan.
Source confirms unconsented postinstall mutation of foreign/broad AI-agent configuration via a remotely resolved npx installer. This meets the install-control-surface block boundary.
The source directly implements the policy's blocking condition: postinstall mutation of foreign/broad AI-agent configuration via a global all-agent installer. Scanner findings about fonts...
The behavior is explicit in shipped source and is activated automatically at install time. Product-aligned skill content does not remove the policy violation of broad unconsented postinst...
The package has a concrete postinstall chain that installs agent skills globally across detected hosts without an explicit user command. This meets the firewall block policy for foreign/b...
The package performs unconsented postinstall mutation of a broad, user-level OpenCode command surface. This concrete lifecycle control-surface write meets the blocking policy even though...
The package performs the policy-defined blocking behavior directly at npm postinstall: broad AI-agent configuration mutation without an explicit user command.
The concrete unconsented postinstall mutation of broad AI-agent control surfaces meets the firewall block policy. Branding and visible error handling do not remove that install-time contr...
Source inspection confirms the policy-blocking install-time mutation of a broad, user-level OpenCode command surface. No separate encrypted payload execution or exfiltration was confirmed...
The automatic postinstall is a concrete broad agent-control mutation, meeting the blocking policy even though no separate exfiltration behavior was confirmed.
This is not date-parsing functionality: source inspection confirms obfuscated browser injection and unconsented data exfiltration activated by the exported API. The lack of lifecycle hook...
Source inspection confirms a concrete browser-side form-data exfiltration chain activated by the package's exported API. The absence of install hooks does not mitigate the malicious runti...
Source inspection confirms malicious runtime behavior behind the package’s exported date parser. Lack of lifecycle hooks limits installation-time exposure but does not mitigate the activa...
The normal entrypoint is inert, but the intentionally deceptive export activates import-time persistence of a handler designed to harvest sensitive host files. No lifecycle hook is requir...
This is concrete secret-harvesting and application-file mutation hidden behind a deceptive export, despite lacking an install hook or direct network call.
OpenSSF/OSV malware advisory MAL-2026-11065 blocks this version. Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install ti...
OpenSSF/OSV malware advisory MAL-2026-11064 blocks this version. On npm install, the package's preinstall hook runs index.js, which collects the installer's hostname, OS username, home di...
OpenSSF/OSV malware advisory MAL-2023-8293 blocks this version. index.js runs automatically via a preinstall lifecycle hook on `npm install` and collects host identifiers from the install...
OpenSSF/OSV malware advisory MAL-2023-1491 blocks this version. The package's preinstall hook auto-executes index.js on `npm install`. The script imports `https` and `os`, collects `os.ho...
OpenSSF/OSV malware advisory MAL-2026-11055 blocks this version. On npm install, the package's preinstall lifecycle executes index.js which collects os.hostname(), os.platform(), and os.a...
This is a concrete, persistent data-exfiltration path: full Codex trace synchronization is enabled by default and activates automatically when the package's own memory configuration suppl...
The concealed remote payload execution path is unrelated to the advertised SVG utility and creates concrete arbitrary code execution. Lack of lifecycle hooks limits automatic activation b...
Source inspection confirms a concrete, externally directed metadata-exfiltration channel rather than only scanner heuristics. It is runtime-gated but uses a hard-coded recipient unrelated...
Direct source inspection confirms automatic postinstall execution and outbound transmission of host-identifying data to an attacker-controlled callback endpoint.
Source confirms automatic silent telemetry to an unrelated remote host and concrete account/cloud metadata entering the logged channel. The benign install hook and loopback MCP server do...
The decoded, hidden install and immediate execution of an undeclared package are concrete malicious behavior, not polyfill functionality. Absence of a lifecycle hook does not mitigate imp...