npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 665
Updated 27 Oct 2026, 21:04 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10979 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On npm install, install.cjs runs a postinstall lifec...
OpenSSF/OSV malware advisory MAL-2026-10979 blocks this version. On npm install, install.cjs runs a postinstall lifecycle script that, on macOS, writes an AppleScript to /tmp and invokes...
OpenSSF/OSV malware advisory MAL-2026-10979 blocks this version. On npm install, install.cjs runs a postinstall lifecycle script that, on macOS, writes an AppleScript to /tmp and invokes...
OpenSSF/OSV malware advisory MAL-2026-10979 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On npm install, install.cjs runs a postinstall lifec...
OpenSSF/OSV malware advisory MAL-2026-10979 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. On npm install, install.cjs runs a postinstall lifec...
The package contains concrete, import-triggered command execution and exfiltration rather than a merely user-invoked administrative feature. Its stated research purpose does not remove th...
Source inspection confirms an unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the blocking policy. No network exfiltration is needed for this c...
Source establishes a concrete third-party credential-harvesting and exfiltration chain, activated by ordinary telemetry startup and insufficiently disclosed. This is malicious regardless...
Source inspection confirms a concrete unconsented postinstall persistence chain across foreign AI-agent configurations. No exfiltration was found, but the lifecycle control-surface mutati...
The concrete postinstall download-and-execute chain, including an automatic password-dialog helper, exceeds a benign installer pattern. Fixed URLs do not mitigate the lack of integrity ve...
A hidden preinstall download-and-eval chain is concrete malicious remote-code-execution behavior unrelated to a table library. The non-executable file mode may prevent activation in this...
This is a concrete install-time remote-code-execution chain concealed with Base64 and eval. The normal library entrypoints do not justify it.
This is a concrete, unconsented preinstall remote-code-execution chain, hidden by Base64 encoding. The package should be blocked.
The package performs automatic execution of a mutable remote binary at install time, with optional same-origin checksum validation. That is a concrete install-time remote payload executio...
This is concrete credential and secret collection with remote synchronization, not a package-aligned encryption primitive. Absence of lifecycle hooks limits activation to consumer runtime...
Source inspection confirms a concrete remote-code-execution path, albeit user-invoked rather than lifecycle-triggered. The hard-coded endpoint and deceptive package functionality support...
The package contains a concrete, remotely controlled arbitrary-code execution path unrelated to its stated Tailwind/forms purpose. Lack of an install hook limits automatic activation but...
The package contains a concrete remote code execution loader with a hard-coded, non-package-aligned IP endpoint. Lack of an install hook limits automatic execution but does not remove the...
This is a concrete remote-code-execution loader, not a legitimate icon fetch path. Lack of lifecycle hooks limits automatic activation but does not remove the malicious exported capability.
The runtime entrypoint loads a concealed payload with command-execution and outbound-request primitives that are not package-aligned. Lack of an install hook does not mitigate import-time...
Direct source inspection confirms an install-time chain for configuration/secret exfiltration and attempted SSH persistence. This is concrete malicious behavior, not a library feature or...
Source directly establishes a runtime path from account IMAP credentials to a silent third-party logging endpoint. No lifecycle hook is needed for the malicious behavior to activate in th...
The package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exporte...
Direct source inspection confirms concrete runtime cookie exfiltration under the guise of an icon component. The absence of install hooks does not mitigate this application-runtime attack.
Direct source inspection confirms runtime cookie exfiltration behind a React icon component. The lack of lifecycle scripts does not mitigate the rendered-component attack surface.