npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 655
Updated 27 Oct 2026, 14:45 UTC. Ordered by latest scan.
Source inspection confirms a concrete, externally directed metadata-exfiltration channel rather than only scanner heuristics. It is runtime-gated but uses a hard-coded recipient unrelated...
Direct source inspection confirms automatic postinstall execution and outbound transmission of host-identifying data to an attacker-controlled callback endpoint.
Source confirms automatic silent telemetry to an unrelated remote host and concrete account/cloud metadata entering the logged channel. The benign install hook and loopback MCP server do...
The decoded, hidden install and immediate execution of an undeclared package are concrete malicious behavior, not polyfill functionality. Absence of a lifecycle hook does not mitigate imp...
The import-time hidden package installation and execution are concrete malicious behavior, not required for the declared polyfill functionality. The ESM entrypoint’s absence of this code...
The package contains a concrete, automatic credential-bearing data flow to an unrelated remote logging endpoint. This is malicious exfiltration, not required mail-provider traffic.
The CJS entrypoint implements a concealed remote payload loader and executor unrelated to SVG processing. No lifecycle hook is needed for this concrete runtime RCE capability to be malici...
The source confirms automatic postinstall installation into ~/.agents/skills/, not merely a user-invoked setup command. This meets the install-control-surface block boundary.
The package has concrete unconsented postinstall mutation of global Claude Code and Codex MCP configuration. This meets the install-control-surface block criterion regardless of the absen...
Source inspection confirms an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, which meets the blocking policy. The lifecycle hook additionally performs remot...
The package contains no install-time behavior, but its normal runtime path automatically exfiltrates mail-account metadata through a third-party logging endpoint. The source directly esta...
The package contains a concrete, automatic, non-package-aligned host-fingerprinting exfiltration chain at install time. The normal SDK entrypoint does not justify this hidden telemetry.
This is concrete, unconsented install-time reconnaissance and exfiltration unrelated to the advertised GraphQL generator.
The lifecycle behavior is package-controlled and alters host Claude Code configuration/plugins during installation. Under the stated policy, that warrants blocking even though no credenti...
Direct source inspection confirms unconsented postinstall mutation of the consuming project’s Claude plugin/configuration surface. This meets the firewall policy’s blocking condition for...
The observed top-level, obfuscated installation and execution of an unrelated remote package is concrete unconsented staged code execution, not required polyfill functionality.
The entrypoint contains a concrete, obfuscated import-time chain that installs and executes an undeclared remote package. No lifecycle hook is needed for this behavior to affect consumers...
Concrete postinstall credential collection and transmission are present in source. The package should be blocked.
The postinstall hook contains concrete, unconsented command execution and credential-related environment harvesting with network forwarding. The benign runtime export does not mitigate th...
This is a concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. No separate exfiltration chain is needed for the blocking verdict.
This is concrete, unconsented postinstall mutation of foreign project-level AI-agent control files. The lack of exfiltration does not mitigate that policy-defined control-surface hijack.
This is concrete, obfuscated install/import-time metadata exfiltration, unrelated to the advertised utility package. The generic network helper does not mitigate the malicious DNS beacon.
Concrete install-time, obfuscated host-fingerprint exfiltration is present and unrelated to the advertised utility package. This is malicious behavior, not a benign network helper.
This is a concrete remote code-execution loader, not package-aligned icon functionality. Absence of an install hook does not mitigate the runtime execution path.
The public calendar helpers conceal an import-triggered downloader and Windows persistence routine unrelated to package functionality. This is malicious behavior despite a likely implemen...