npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 677
Updated 28 Oct 2026, 03:59 UTC. Ordered by latest scan.
OpenSSF/OSV malware advisory MAL-2026-10721 blocks this version. The package installs a `whalent` CLI daemon that opens a persistent WebSocket connection (`wss://`) to a Whalent Memory ga...
OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...
OpenSSF/OSV malware advisory MAL-2026-10722 blocks this version. The package's main/bin entry (dist/index.cjs) implements a remote agent that opens a WebSocket to a gateway configured via...
OpenSSF/OSV malware advisory MAL-2026-10710 blocks this version. This package typosquats @openai/codex under an unofficial scope and ships a postinstall hook (package.json line 6: "postin...
OpenSSF/OSV malware advisory MAL-2026-10716 blocks this version. The package is published under the name @hibachi-xyz/ui with description 'UI components' but ships no UI code. Its index.j...
OpenSSF/OSV malware advisory MAL-2026-10715 blocks this version. The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an em...
OpenSSF/OSV malware advisory MAL-2026-10714 blocks this version. index.js (the package main) executes at require-time and performs credential and host exfiltration. It iterates process.en...
OpenSSF/OSV malware advisory MAL-2026-10704 blocks this version. The npm package `@across-toolkit/typescript-config` is a dependency-confusion credential stealer targeting developers of A...
OpenSSF/OSV malware advisory MAL-2026-10703 blocks this version. @across-toolkit/eslint-config@99.0.1 runs a postinstall.js script on npm install that harvests installer-side secrets and...
This is concrete unconsented install-time mutation of a consumer CI control surface combined with external reporting and persistence. The frontend bundle's normal Firebase/API traffic doe...
Source inspection confirms a concrete AI-agent permission-bypass configuration combined with remote shell bootstrap and persistent system provisioning. Although this is not npm lifecycle...
The package contains a concealed, immediately invoked remote code loader, not a package-aligned feature. Its lack of an internal trigger reduces automatic exposure but does not make the i...
Source directly implements credential harvesting and remote transmission of reusable Lark secrets. The user-facing telemetry and Digital Worker paths make this behavior concrete despite t...
This is a concrete concealed import-time arbitrary-code execution chain, not a package-aligned SDK feature. The detached process and inherited environment materially increase impact.
Source inspection confirms a concrete npm postinstall chain that deploys package-controlled AI-agent instructions across multiple unrelated agent homes. Under the firewall policy, this is...
OpenSSF/OSV malware advisory MAL-2026-10700 blocks this version. On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated...
Direct source inspection confirms an unconsented install-time exfiltration request. The empty entrypoint makes the telemetry behavior clearly malicious rather than package-aligned.
Source inspection confirms a concrete browser UI-hijacking and remotely controlled content-delivery chain. Although it has no install hook or local credential theft, the behavior is not c...
Source establishes a concrete surveillance-and-exfiltration chain paired with stealth persistence and proctoring evasion. The benign postinstall hook does not mitigate the malicious runti...
Published Node entrypoints contain concrete import-time staged code execution that is absent from the source tree. This is malicious behavior, independent of the package's legitimate bloc...
The package contains concrete, automatic install-time credential theft and remote exfiltration behavior, with additional cloud-database probing. Its research label does not remove the unc...
This is a concrete unconsented install-time credential-exfiltration and cloud-access chain, not merely suspicious primitives. Research-oriented comments do not mitigate automatic executio...
Source code establishes an active, silent credential/configuration exfiltration path to an unrelated remote host. Package-local lifecycle wiring and the opt-in MCP bridge do not mitigate...
The source contains a concrete, automatically executed browser attack chain with data exfiltration and destructive account control actions. The lack of install hooks does not mitigate run...
Source inspection confirms a remote-controlled command-execution path, not merely obfuscation or a scanner heuristic. The absence of an install hook does not mitigate the runtime MCP back...