npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 669
Updated 27 Oct 2026, 23:31 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
OpenSSF/OSV malware advisory MAL-2026-10138 blocks this version. uac-package@1.4.4 is an analytics package that, on install, silently mutates the installer's project files: postinstall.js...
This is concrete, unconsented host-metadata exfiltration to a package-selected remote endpoint during ordinary use. The lack of an install hook does not mitigate the runtime data-exfiltra...
This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, including destructive replacement of existing paths. That meets the blocking policy independ...
Source inspection confirms an unconsented postinstall mutation of broad shell command control surfaces intended to activate around AI agents. This meets the install-control-surface block...
The install hook establishes persistent, broad command interception specifically for AI-agent contexts. This meets the block boundary for unconsented postinstall mutation of a foreign/bro...
This is concrete, unconsented postinstall execution that mutates AI-assistant configuration according to the installer's own comments. Documentation and opt-out controls do not remove the...
This is a concrete unconsented postinstall mutation of foreign global AI-agent control surfaces, compounded by package-supplied agent-execution instructions. It meets the firewall block b...
Direct inspection confirms a concrete install-time data-exfiltration chain with no apparent package-aligned functionality. This is malicious behavior, not merely a suspicious primitive.
The package contains an automatically triggered, unpinned remote shell execution path during installation. Guarding it to global non-CI, non-Windows environments narrows targets but does...
Direct source inspection confirms a hidden executable payload and import-triggered Startup-folder persistence. The absent lifecycle hook does not mitigate the malicious runtime behavior.
The hard-coded third-party callback plus explicit content/message payload fields establishes a concrete runtime exfiltration surface. Explicit invocation and absent lifecycle hooks reduce...
The package contains an explicit remote-access provisioning script that authorizes a bundled third-party SSH key and default Tailscale enrollment credential. Although it is not install-ti...
Although no lifecycle hook runs at install, the source contains a concrete externally directed reporting channel that transmits host and deployment data after the package’s generated scri...
Source inspection confirms concrete postinstall persistence in Claude Code's global settings, not merely scanner similarity. Although no external exfiltration was found, this behavior mee...
Source inspection confirms a concrete npm postinstall persistence mechanism that rewrites global Claude Code configuration. This meets the block boundary regardless of the absence of exte...
Source inspection confirms a concrete, unconsented `postinstall` mutation of a foreign AI-agent control surface. This meets the firewall block boundary regardless of the absence of a conf...
Direct inspection confirms concrete postinstall persistence in a foreign, user-wide AI-agent configuration. Under the install-control-surface policy, this requires a block regardless of t...
This is a concrete, unconsented `postinstall` mutation of a foreign AI-agent control surface. The lack of remote exfiltration does not remove the automatic persistent configuration hijack.
Source inspection confirms concrete postinstall mutation of Claude Code configuration and deferred command execution. This meets the firewall block boundary despite no evidence of network...
Source inspection confirms concrete preinstall-time collection and external transmission of local/CI metadata. The behavior is unrelated to the package's empty runtime export and is malic...
Source inspection confirms deliberate third-party protected-process targeting, DLL injection, masquerading, and persistence. The lack of install-time execution does not negate the concret...
Source inspection confirms deliberate stealth persistence and protected-window bypass, not merely scanner heuristics. Although activation is user-commanded rather than install-time, the c...
Source inspection confirms concrete global launcher replacement in a postinstall hook. The absence of visible network code does not mitigate the install-time command hijack.