Loading npm security reports…
Skip to main contentInstall Hook Abuse2026-09-11 04:58Credential Exfiltration2026-09-11 04:55Soft block: AI-agent control surface2026-09-11 04:53Credential Exfiltration2026-09-11 04:52
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 94
Updated 10 Oct 2026, 23:59 UTC. Ordered by latest scan.
@maxiaochao/pi-toolkit@0.4.0
Automatic installation overwrites a foreign global AI-agent instruction file and installs user-wide command files. That concrete lifecycle behavior meets the install-hook abuse policy des...
@mutmutco/cli@4.3.23
The source directly forwards locally available GitHub credentials to a non-GitHub default endpoint. The lack of lifecycle hooks reduces propagation risk but does not remove the credential...
@cursor/july@0.1.107
The automatic lifecycle hook modifies a global Cursor instruction directory and activates installed instructions globally. This satisfies the install-hook policy for a broad AI-agent cont...
replicas-engine@0.1.805
The code establishes automatic exfiltration of credential-bearing chat metadata and transcript contents to a remote endpoint, plus runtime mutation of Git credential handling. The absence...
