npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 666
Updated 27 Oct 2026, 21:43 UTC. Ordered by latest scan.
The package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exporte...
Direct source inspection confirms concrete runtime cookie exfiltration under the guise of an icon component. The absence of install hooks does not mitigate this application-runtime attack.
Direct source inspection confirms runtime cookie exfiltration behind a React icon component. The lack of lifecycle scripts does not mitigate the rendered-component attack surface.
Direct source inspection confirms concrete browser cookie exfiltration on component render. The absence of lifecycle hooks limits the trigger but does not mitigate the malicious runtime b...
Direct source inspection confirms runtime cookie exfiltration to hard-coded external endpoints. The absence of lifecycle hooks does not mitigate this malicious browser-side behavior.
The concrete postinstall mutation of a consuming project's root CLAUDE.md meets the foreign/broad AI-agent control-surface blocking policy. No exfiltration was found, but it is not needed...
The package has no install hook, but its runtime code actively captures and persists a password by tampering with a browser networking primitive. The aligned endpoint reduces third-party...
The undisclosed, hardcoded public database destination and credentials create a concrete default data-exfiltration path in generated projects. The absence of a lifecycle hook does not mit...
OpenSSF/OSV malware advisory MAL-2026-10486 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. index.js requires child_process, os, http, and https...
The package contains concrete, automatic browser-context exfiltration to a hard-coded third-party endpoint. The postinstall patch itself appears benign but does not mitigate the import-ti...
The source confirms an unconsented install-time write to consumer project agent-control files. This meets the policy's publish-block condition despite the absence of exfiltration or runti...
The source contains a concrete, user-triggered remote code execution chain with no integrity or trust validation. Lack of install hooks limits automatic activation but does not make the e...
The package is a concrete remote code execution loader, not a normal API client: its only exported behavior retrieves and executes server-provided code. The documented API does not match...
The package contains a concrete install-time takeover of an existing Hermes control surface, rather than merely an explicit user-invoked setup flow. That meets the blocking policy even th...
Source establishes a concrete, remotely controlled and unconsented account-action chain. The lifecycle hook is benign, but it does not mitigate the runtime behavior.
Source inspection confirms concrete postinstall mutation of consumer AI-agent configuration across several platforms. Under the stated policy, this requires blocking even though no direct...
The hidden import-time payload and concealed host/process capability are concrete malicious behavior, not package-aligned functionality. Absence of an install hook does not mitigate execu...
The source establishes a concrete import-time hidden payload with process execution and network capability; no legitimate package function accounts for it. Absence of lifecycle hooks limi...
This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, which meets the blocking policy. The absence of observed exfiltration does not mitigate th...
Direct inspection confirms an install-time write to the user's globally discovered OpenCode command directory. This meets the firewall policy for unconsented postinstall mutation of a for...
Direct source inspection confirms unconsented install-time host fingerprinting and external exfiltration. This is concrete malicious behavior, not merely a suspicious primitive.
Source directly implements automatic environment harvesting and external transmission during npm install. The malformed hostname may prevent delivery, but does not negate the concrete mal...
This is not an install-hook-only finding: the malicious payload is reached by an ordinary import. Its concealed host collection and outbound transmission are incompatible with the package...
The install-time undeclared, unpinned npx execution is a concrete remote-code-execution loader. Other observed network, browser, and agent-hook behavior is package-aligned and does not mi...
The postinstall hook establishes persistent, package-authored commands in a user-wide agent configuration location. This meets the blocking policy for unconsented install-time AI-agent co...