Loading npm security reports…
Skip to main contentCredential Exfiltration2026-09-27 03:20Soft block: AI-agent control surface2026-09-27 03:00Soft block: AI-agent control surface2026-09-27 02:54Soft block: AI-agent control surface2026-09-27 02:49
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 67
Updated 10 Oct 2026, 06:15 UTC. Ordered by latest scan.
my-skibidi@1.0.3
The active entrypoint implements unsolicited browser credential and data collection followed by transmission to an unrelated external endpoint. This is concrete credential and data exfilt...
agent-takkub@2.1.42
The automatic lifecycle hook provisions a foreign AI-agent CLI and persists shell configuration changes. This is concrete unconsented install-time control-surface mutation.
@customerio/cli@0.0.28
The package performs an unconsented postinstall invocation that installs AI-agent skills at project or global scope. This meets the install-control-surface blocking rule.
dsh-git-badge@0.15.0
The package combines automatic lifecycle execution with writes to a foreign DSH host and user agent-skill catalog. The stated safeguards limit when files are changed but do not remove the...