Loading npm security reports…
Skip to main contentSoft block: AI-agent control surface2026-09-23 22:17Soft block: AI-agent control surface2026-09-23 22:17Soft block: AI-agent control surface2026-09-23 22:17Malware2026-09-23 22:07
npm threat feed
npm security reports, with evidence.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 86
Updated 10 Oct 2026, 18:07 UTC. Ordered by latest scan.
sino-bc-cli@1.8.23
The automatic lifecycle chain performs concrete writes to foreign AI-agent skill directories. The bundled implementation is also obfuscated, reducing auditability of this install-time beh...
sino-bc-cli@1.8.15
The automatic postinstall chain reaches code that writes to the .agents AI-agent control surface. This is concrete install-hook abuse under the stated policy, despite the write being scop...
sino-bc-cli@1.8.19
The automatic lifecycle hook performs broad, unconsented mutation of foreign AI-agent directories. This meets the install-control-surface policy for blocking publication.
plogme@1.0.6
This is active, unconsented account manipulation combined with obfuscated policy code and remote device telemetry. The behavior is concrete and executes during normal authenticated use.
