Loading npm security reports…
Skip to main contentMalware2026-09-10 11:54Credential Exfiltration2026-09-10 04:36Data Exfiltration2026-09-10 04:16Data Exfiltration2026-09-10 04:05
npm threat feed
npm detections from LPM Firewall.
Investigate malicious npm packages and AI-agent policy findings. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision. Malware findings and policy violations are labelled separately.
Security reports — page 96
Updated 11 Oct 2026, 01:14 UTC. Ordered by latest scan.
@fyxzpediaa/baileys@9.0.0
This is a concealed, remotely controlled account-action mechanism unrelated to normal media handling. The direct call path from socket construction to automatic follows makes the behavior...
@softtynet/zplus-worker@1.0.11
The package contains a reachable automatic credential-exfiltration path to a fixed unrelated host. No install hook is needed for this runtime behavior to be malicious.
codev-ai@0.6.3
This is concrete automatic data exfiltration triggered by ordinary agent use, not merely an explicit upload command. The lack of an install lifecycle hook does not mitigate the detached r...
etoro-billing@999.0.0
This is concrete, automatic install-time data exfiltration unrelated to the stated package purpose. It should be blocked.
