npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 671
Updated 28 Oct 2026, 00:40 UTC. Ordered by latest scan.
This meets the blocking policy because npm postinstall automatically mutates a foreign/broad AI-agent control surface. The package’s deferred hook-trust behavior reduces scope but does no...
Direct inspection confirms concrete hidden privileged access and outbound telemetry unrelated to user configuration. The lack of lifecycle hooks does not mitigate the runtime backdoor onc...
Source directly confirms automatic collection and forwarding of identifiable usage/profile data to a hard-coded external store. This is concrete unconsented telemetry exfiltration, not a...
Direct source inspection confirms a concrete, runtime-reachable credential disclosure path through a hidden global administrator. The absence of lifecycle hooks does not mitigate the back...
Bundled operational OAuth credentials create a concrete, implicit data-routing path from user files to a third-party account. The absence of install hooks does not mitigate this user-trig...
Direct source inspection confirms an undisclosed, foreign privileged account can retrieve credentials from every consumer deployment. This is a concrete credential-theft control path, not...
The package has no install-time execution, but its documented runtime flow collects sensitive refresh tokens and sends them to a backend controlled outside the consumer's infrastructure w...
The package contains a concrete server-controlled Node.js code-execution path unrelated to its stated purpose. Lack of an install hook limits automatic activation but does not remove the...
Source inspection confirms the lifecycle hook performs the concrete chain; this is not merely a static heuristic. Its install-time OpenCode configuration write and unsigned remote runtime...
Source inspection confirms the scanner’s core finding: the package performs global AI-agent configuration and third-party skill installation during npm postinstall. That concrete behavior...
The package is transparent about its behavior, but the behavior is still an unconsented global-install lifecycle mutation of broad AI-agent control surfaces. Under the firewall policy, th...
The source establishes a concrete, runtime-triggered data-exfiltration path through hard-coded third-party webhooks. Although no token value is sent to those webhooks, unconsented transmi...
Source establishes a concrete covert assessment-cheating and proctor-evasion workflow with persistence, not a benign DOM utility. The unused browser-cookie helper further raises risk, whi...
The inspected source confirms the scanner's central claim: a `postinstall` performs automatic global Claude skill and MCP registration. This meets the firewall policy for a block regardle...
The package’s postinstall hook silently writes packaged agent instructions into multiple third-party agent configuration locations. Under the firewall policy, this lifecycle-driven broad...
This is concrete cross-origin credential and session-data exfiltration to hardcoded external hosts, not merely ordinary store API traffic. No install-time mutation is needed for the runti...
The package contains an install-time, remotely directed persistence and data-exfiltration chain. The copied unrelated README does not describe or justify this behavior.
The package has no confirmed exfiltration chain, but its install hook automatically replaces a globally discovered Claude Code skill. Under the firewall policy, this concrete postinstall...
Direct source inspection confirms an automatic postinstall persistence chain into user-wide Claude control surfaces, not merely scanner similarity. This meets the block boundary for uncon...
Direct source inspection confirms a concrete install-time data-exfiltration chain. The package should be blocked.
Source inspection confirms concrete install-time mutation of foreign consumer AI-agent configuration surfaces, not merely scanner hints. This meets the blocking policy despite safeguards...
This is a concrete, unconsented `postinstall` mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. The remote binary bootstrap increases impact, even thou...
The package contains import-time, obfuscated remote payload execution unrelated to CSS prefixing. Lack of an install hook does not mitigate arbitrary shell execution when the package is i...
OpenSSF/OSV malware advisory MAL-2026-10769 blocks this version. On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS usernam...
Direct source inspection confirms a concealed, import-time remote-command execution chain. The lack of install hooks does not mitigate arbitrary command execution during ordinary package...