Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-26 11:25Install Hook Abuse2026-09-26 11:08Install Hook Abuse2026-09-26 11:08Soft block: AI-agent control surface2026-09-26 07:42
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 68
Updated 10 Oct 2026, 06:55 UTC. Ordered by latest scan.
superoc@0.1.25
The automatic postinstall performs broad, unconsented mutation of an external AI-agent configuration and establishes a lifecycle self-dependency chain. This is concrete install-hook abuse...
sandbox-pentest-assessment@2.0.1
The preinstall hook performs broad host reconnaissance and deliberately publishes the report world-readable under /tmp for a less-privileged reader. That is concrete install-hook abuse ev...
sandbox-pentest-assessment@1.0.0
The preinstall hook unconditionally performs broad host and container-escape reconnaissance and stores it on disk, which is concrete install-hook abuse. Claims that the package is a read-...
@social-data/social-neuron-metadata-query@1.0.0
Unconsented postinstall mutation of the OpenClaw skills directory is a foreign AI-agent control-surface write. The skill content is product documentation, but that does not remove the aut...
