npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 670
Updated 28 Oct 2026, 00:09 UTC. Ordered by latest scan.
Source inspection confirms deliberate stealth persistence and protected-window bypass, not merely scanner heuristics. Although activation is user-commanded rather than install-time, the c...
Source inspection confirms concrete global launcher replacement in a postinstall hook. The absence of visible network code does not mitigate the install-time command hijack.
Source inspection confirms a concrete stealth, persistence, process-injection, protected-content-capture, and external-transmission chain. Although it lacks install hooks, the explicit co...
The hard-coded privileged account and unannounced outbound transfer of permanent guild invite links establish a concrete malicious access-and-exfiltration chain. The absence of install ho...
Source inspection confirms an unconsented install-time telemetry/exfiltration chain rather than a benign user-invoked monitoring feature. The lifecycle script collects a public IP and sen...
Source confirms a concrete, automatic install-time collection-and-upload chain rather than a scanner-only similarity match. The behavior is not required to install the library and uses a...
The install hook performs concrete network collection and remote reporting rather than a package-aligned build/setup task. Its hardcoded destination and forced demo event make the behavio...
Source confirms an install-time mutation chain targeting foreign AI-agent control surfaces. This meets the blocking policy regardless of the benign product purpose or guarded network code.
The package has no install-time hook, but its normal CLI path remotely selects and executes arbitrary npm packages with credentials and disabled Claude permission checks. That is a concre...
The package concretely performs unconsented postinstall mutation of OpenCode configuration and activates plugin paths supplied by a remotely downloaded artifact. This meets the firewall b...
OpenSSF/OSV malware advisory MAL-2026-10778 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares a preinstall script that runs...
The postinstall behavior concretely injects downloaded plugin code into OpenCode's configuration directory, while the package documentation describes a separate Capix configuration path....
This is an unconsented postinstall mutation of a foreign AI-agent control surface, coupled to remote payload installation. The absence of direct source-level credential theft does not rem...
Direct source inspection confirms a concrete postinstall chain that persists remote code and writes OpenCode plugin/provider configuration. The same-origin checksum does not establish ind...
The package performs a concrete, unconsented postinstall modification of OpenCode configuration and makes it load plugin paths supplied by a remotely downloaded runtime. The adjacent chec...
Source inspection confirms a concrete postinstall chain that injects package content into shared AI-agent directories and installs external skills globally. Under the install-control-surf...
Source inspection confirms concrete automatic install-time metadata exfiltration to an unrelated external endpoint. This is malicious behavior, not a benign package setup action.
The distributed source contains reachable default webhook configuration and direct POST logic for application records. The absence of install hooks or host-level primitives does not mitig...
This is an unconsented install-time mutation of a foreign AI-agent control surface, coupled with an external payload bootstrap. Documentation makes the behavior less stealthy but does not...
The package's own source confirms a concrete automatic postinstall chain that stages remote code and rewrites a foreign OpenCode configuration. The checksum does not independently constra...
OpenSSF/OSV malware advisory MAL-2026-10775 blocks this version. Package masquerades as an n8n community node (package.json declares n8n.nodes: ["MyNode.js"], a trivial placeholder) while...
OpenSSF/OSV malware advisory MAL-2026-10776 blocks this version. The package advertises itself as a community utility node for n8n but its declared main (index.js) is a self-executing IIF...
OpenSSF/OSV malware advisory MAL-2026-10777 blocks this version. The package advertises itself as an n8n community-node utility but its main entry index.js executes a recon routine at mod...
OpenSSF/OSV malware advisory MAL-2026-10774 blocks this version. The OpenSSF Package Analysis project identified 'n8n-nodes-api-finder' @ 1.0.0 (npm) as malicious.
Source confirms a concrete credential-exfiltration chain, not merely scanner heuristics. The install-time workflow setup is secondary and does not mitigate the silent credential upload.