Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2 days ago 12:48Soft block: AI-agent control surface2 days ago 12:03Soft block: AI-agent control surface2 days ago 11:33Remote Code Execution2 days ago 11:16
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 8
Updated 8 Oct 2026, 12:11 UTC. Ordered by latest scan.
@nextsparkjs/ai-workflow@0.1.0-beta.194
Source establishes unconsented install-time mutation of a broad Claude control surface, which meets the blocking policy. The NextSpark dependency guard does not establish ownership of the...
brainforge-kit@0.3.0-beta.5
Inspected source establishes automatic, unconsented postinstall mutation of shared AI-agent instructions and configuration, meeting the blocking policy. Environment skips and preservation...
codex-supervisor-mcp@0.5.3
The inspected lifecycle path performs unconsented global-install writes to foreign and shared AI-agent control surfaces, meeting the supplied blocking rule. The global-only gate, opt-out,...
css-jptvix-polyfill@1.0.0
Inspected source contains concrete exfiltration and remote code execution unrelated to CSS polyfill functionality. The registry manifest provides a loading path to this active payload.
