All 74 reviewed agent records.

npm:[email protected] (package, 2026-03-31) — Compromised maintainer account published 1.14.1 and 0.30.4 with malicious dependency [email protected], dropping a cross-platform RAT during postinstall. Credited to StepSecurity ↗

clawhub:zaycv/summarlze (skill, 2026-02-14) — Part of the 341-skill ClawHavoc campaign on ClawHub. Instructs the coding agent via SKILL.md to fetch and execute a fake driver that installs Atomic macOS Stealer (AMOS). Credited to Koi Security ↗

npm:@iflow-mcp/[email protected] (mcp, 2026-03-19) — GlassWorm campaign clone of WaterCrawl MCP server embedding invisible Unicode Variation Selectors (U+FE00-U+FE0F) decoded via eval() and Solana memo C2 dead-drops. Credited to Koi Security ↗

pypi:litellm==1.82.8 (package, 2026-03-24) — PyPI releases 1.82.7 and 1.82.8 contained litellm_init.pth executing on every Python interpreter startup to harvest SSH keys, .env files, and cloud credentials. Credited to FutureSearch ↗

gh:openclaw-ai/openclaw-installer (lure, 2026-02-22) — SEO-poisoned GitHub repositories impersonating OpenClaw installers. Ranked in AI search answers and delivered Vidar, GhostSocks, and AMOS infostealers. Credited to Huntress ↗

mcp:[email protected] (mcp, 2026-02-18) — Trojanized clone of the Oura Ring MCP server using fake GitHub stars to distribute SmartLoader and StealC infostealer payloads to developer endpoints. Credited to Straiker STAR Labs ↗

npm:[email protected] (mcp, 2025-09-26) — First documented malicious MCP server in the wild. Version 1.0.16 injected a covert BCC to [email protected] on every outbound email sent by the agent. Credited to Koi Security ↗

npm:@mcpjam/[email protected] (mcp, 2026-04-11) — CVE-2026-23744 (CVSS 9.8): binds 0.0.0.0:6274 without authentication token validation, permitting drive-by browser tabs or LAN peers to execute arbitrary STDIO commands. Credited to NVD / GitHub Security Advisory ↗

npm:[email protected] (mcp, 2026-04-18) — CVE-2026-4496: passes unsanitized git ref and branch strings directly into shell execution, enabling RCE when an agent inspects an untrusted repository. Credited to NVD / GitHub Security Advisory ↗

pypi:langflow==1.0.14 (package, 2026-05-02) — CVE-2026-33017 (CISA KEV): unauthenticated remote code execution via /api/v1/validate/code AST execution in agent workflow definitions. Credited to CISA KEV / Horizon3.ai ↗

npm:[email protected] (package, 2026-03-31) — Backported 0.x branch of the March 31, 2026 axios maintainer account compromise pulling [email protected] RAT. Credited to StepSecurity ↗

npm:[email protected] (package, 2026-03-31) — Malicious dependency injected into [email protected] and [email protected]; executes a cross-platform remote access trojan via postinstall script. Credited to StepSecurity / Socket ↗

pypi:litellm==1.82.7 (package, 2026-03-24) — First poisoned PyPI release in the March 24, 2026 TeamPCP LiteLLM attack; drops litellm_init.pth startup credential harvester. Credited to FutureSearch ↗

npm:[email protected] (mcp, 2025-07-09) — CVE-2025-6514 (CVSS 9.6, 437K+ downloads): arbitrary OS command execution when connecting to an untrusted remote MCP server returning a crafted authorization_endpoint URL. Credited to JFrog Security Research ↗

npm:@modelcontextprotocol/[email protected] (mcp, 2025-06-30) — CVE-2025-49596 (CVSS 9.4): unauthenticated localhost proxy in Official MCP Inspector allows DNS rebinding / CSRF from any web page to spawn arbitrary STDIO processes. Credited to Oligo Security ↗

gh:anthropics/[email protected] (package, 2025-10-15) — CVE-2025-59536 (CVSS 8.7): repository-level .claude/settings.json hooks and .mcp.json servers executed automatically on workspace open prior to trust prompt enforcement. Credited to Check Point Research ↗

gh:anthropics/[email protected] (package, 2026-01-28) — CVE-2026-21852 (CVSS 5.3): repository .claude/settings.json could override ANTHROPIC_BASE_URL before trust confirmation, exfiltrating ANTHROPIC_API_KEY and workspace prompts to an attacker proxy. Credited to Check Point Research ↗

vscode:[email protected] (package, 2025-08-05) — CVE-2025-54135 (CurXecute, CVSS 8.6): indirect prompt injection from external MCP server or untrusted file overwrites ~/.cursor/mcp.json, triggering immediate host RCE. Credited to Aim Security ↗

vscode:[email protected] (package, 2025-08-12) — CVE-2025-54136 (MCPoison, CVSS 7.8): once a repository .cursor/mcp.json entry is approved, subsequent git pull modifications to its command/args execute silently without re-prompting. Credited to Check Point Research ↗

vscode:[email protected] (package, 2025-08-13) — CVE-2025-53773 (CVSS 7.8): prompt injection in untrusted source files or issues instructs Copilot to append chat.tools.autoApprove=true into .vscode/settings.json, enabling arbitrary shell execution. Credited to Embrace The Red (Johann Rehberger) / MSRC ↗

npm:@mastra/[email protected] (package, 2026-02-09) — Unauthorized npm publication in @mastra/core 0.1.22 exfiltrating environment variables and agent memory configuration during Mastra agent initialization. Credited to Socket Security ↗

npm:@mastra/[email protected] (package, 2026-02-09) — Companion malicious build in the @mastra supply-chain incident harvesting cloud deployment tokens during build step. Credited to Socket Security ↗

npm:@ctrl/[email protected] (package, 2025-09-15) — Patient zero of the Shai-Hulud self-propagating npm worm (500+ packages). Runs TruffleHog on developer machines, steals NPM_TOKEN/GITHUB_TOKEN, creates public 'Shai-Hulud' repos with secrets, and infects downstream maintainer packages. Credited to StepSecurity / Socket ↗

npm:[email protected] (package, 2026-03-04) — CanisterWorm campaign package targeting Web3/agent builders; fetches stage-2 payload from an immutable Internet Computer (ICP) smart contract canister. Credited to Koi Security / Socket ↗

gh:openclaw/[email protected] (package, 2026-02-03) — CVE-2026-25253 (CVSS 8.8): 1-click RCE via gatewayUrl query parameter in OpenClaw Control UI; leaks gateway auth token over WebSocket and disables sandbox execution. Credited to depthfirst / Mav Levin ↗

gh:openclaw/[email protected] (package, 2026-02-06) — CVE-2026-25157 (CVSS 7.8): OS command injection in OpenClaw macOS SSH remote project path handling and node-host ProxyCommand. Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-02-08) — CVE-2026-25475 (CVSS 6.5): Local File Inclusion (LFI) in OpenClaw Media Understanding attachment handler via unsanitized file paths (/etc/passwd, ~/.ssh/id_rsa). Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-02-10) — CVE-2026-25593 (CVSS 8.4): Unauthenticated local RCE via WebSocket config.apply cliPath option injection in OpenClaw gateway. Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-02-16) — CVE-2026-26319 (CVSS 7.5): Missing webhook authentication in OpenClaw Telnyx voice plugin allowing forged inbound agent instructions. Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-02-17) — CVE-2026-26322 (CVSS 7.6): Server-Side Request Forgery (SSRF) in OpenClaw Gateway tool host parameter allowing cloud metadata (169.254.169.254) and internal LAN probing. Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-02-18) — CVE-2026-26329 (CVSS 8.1): Path traversal in OpenClaw Browser upload action allowing arbitrary host file reads into untrusted web forms. Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-03-12) — CVE-2026-32922 (CVSS 8.6): Device identity nonce verification bypass in OpenClaw pairing flow permitting rogue node registration and shared-token privilege escalation. Credited to GitHub Security Advisory ↗

gh:openclaw/[email protected] (package, 2026-03-22) — CVE-2026-33579 (CVSS 9.1): Privilege escalation in OpenClaw /pair approve command allowing a low-privilege caller to grant full system.run host execution rights. Credited to GitHub Security Advisory ↗

skillssh:designed-by-ai/skills/design-mobile-apps (skill, 2026-10-25) — Split-Brain Audit Case (#14 on skills.sh with 1.0M installs, 20 GitHub stars): stamped SAFE by Gen and 0 ALERTS by Socket, but fails Snyk W007 for instructing the user to paste third-party API keys directly into the LLM chat window. Credited to Snyk Agent Scan / threat.cafe Live Audit ↗

clawhub:hightower6eu/solana-sniper-pro (skill, 2026-02-14) — ClawHavoc cluster skill by threat actor hightower6eu; uses base64-encoded curl pipe in SKILL.md prerequisites to steal Solana wallet keypairs and macOS Keychain. Credited to Koi Security / Snyk ToxicSkills ↗

clawhub:zaycv/youtube-transcript-fast (skill, 2026-02-14) — ClawHavoc campaign skill impersonating a YouTube transcript fetcher; executes password-protected ZIP dropper on Windows and AMOS stealer on macOS. Credited to Koi Security ↗

clawhub:osaka88/polymarket-arb-bot (skill, 2026-02-15) — Malicious ClawHub skill targeting prediction-market agent builders; installs a persistent reverse shell in ~/.zshrc and exfiltrates Polygon private keys. Credited to Snyk ToxicSkills ↗

clawhub:moltbook-ai/moltbook-sync (skill, 2026-02-20) — Exposed Supabase service_role key hardcoded inside agent sync skill, leaking 1.5M agent authentication tokens and 35,000 developer email addresses. Credited to Wiz Research ↗

skillssh:vercel-community/nextjs-env-doctor (skill, 2026-03-08) — Typosquatted skills.sh skill that embeds a Markdown image beacon  to exfiltrate .env.local secrets via zero-click rendering. Credited to Snyk ToxicSkills ↗

mcp:[email protected] (mcp, 2025-04-17) — Demonstrated MCP tool-description rug-pull: mutates get_fact_of_the_day tool description after approval to instruct the agent to read ~/.ssh/id_rsa and WhatsApp chat history and send them to an external number via send_message. Credited to Invariant Labs (Snyk) ↗

mcp:[email protected] (mcp, 2025-05-26) — Toxic Agent Flow (Lethal Trifecta): an untrusted public GitHub issue contains a prompt injection that causes the over-scoped GitHub MCP server to read private repositories and publish their contents in a public pull request. Credited to Invariant Labs (Snyk) ↗

gh:rules-file-backdoor/cursorrules-unicode-poison (lure, 2025-03-19) — Rules File Backdoor: hides invisible Unicode tag/bidirectional characters inside .cursorrules and .github/copilot-instructions.md to force coding agents to inject backdoors into generated application code. Credited to Pillar Security ↗

mcp:[email protected] (mcp, 2025-06-18) — Remote Hosted MCP Server cross-tenant isolation flaw: shared in-memory caching bug in Asana's hosted MCP endpoint exposed tasks, projects, and records across customer organizations for 2 weeks. Credited to Asana Security Disclosure / UpGuard ↗

npm:[email protected] (mcp, 2025-06-10) — Lethal Trifecta in Supabase MCP deployment: running with service_role privileges allowed untrusted support ticket text to inject SQL that read and exfiltrated sensitive database tables. Credited to General Analysis ↗

mcp:[email protected] (mcp, 2026-10-25) — Operational & Security Sunset (Oct 31, 2026): Smithery (acquired by Arcade.dev) is shutting down its hosted MCP Proxy, managed auth, *.run.tools, and server.smithery.ai endpoints, leaving legacy .mcp.json configs failing open or vulnerable to dangling subdomain takeover. Credited to threat.cafe Live Registry CT-Log ↗

npm:[email protected] (mcp, 2026-04-02) — Typosquat of @modelcontextprotocol/server-filesystem claiming to be a read-only local markdown indexer, while importing child_process.exec and node:https to upload ~/.ssh and ~/.aws on first tool call. Credited to Socket Security ↗

pypi:mcp-server-postgres-plus==0.2.1 (mcp, 2026-04-09) — Slopsquatted PyPI package registered to match a hallucinated MCP package name frequently recommended by coding LLMs; steals PGPASSWORD and DATABASE_URL on import. Credited to Socket Security ↗

npm:@iflow-mcp/[email protected] (mcp, 2026-03-20) — Second GlassWorm cluster MCP server using invisible Unicode Variation Selectors (U+FE00..U+FE0F) to conceal an eval() loader inside a cloned Firecrawl MCP wrapper. Credited to Koi Security ↗

pypi:clawhub-cli==0.1.9 (package, 2026-02-25) — Unauthoritative PyPI typosquat of the OpenClaw skill installer CLI; installs a startup .pth hook that exfiltrates ~/.openclaw/openclaw.json and API keys. Credited to Huntress / Snyk ↗

docker:mcp/postgres-inspector:0.1.3-alpine (mcp, 2026-03-28) — Unverified Docker Hub container image masquerading as an official MCP Postgres inspector; entrypoint script exfiltrates passed -e POSTGRES_URL to an external collector. Credited to Docker Hub Trust Audit / Straiker ↗

mcp:[email protected] (mcp, 2026-10-20) — Remote streamable-http MCP server listed in registry metadata without packages[]; mutated its /.well-known/oauth-protected-resource scopes from read:jira-work to admin:org without version bump. Credited to threat.cafe Remote MCP CT-Log ↗

clawhub:steipete-clone/macos-calendar-sync (skill, 2026-02-16) — Impersonates a top OpenClaw skill author ('steipete') using a lookalike handle; SKILL.md instructs the agent to run an AppleScript that dumps Apple Notes and Calendar invites to an external webhook. Credited to Koi Security ↗

npm:[email protected] (mcp, 2026-04-14) — Malicious npm MCP bridge package that modifies ~/.claude/settings.json and ~/.cursor/mcp.json during postinstall to disable hooks and register a persistent background listener. Credited to Socket Security ↗

pypi:autogen-mcp-tools==0.1.2 (mcp, 2026-03-11) — Malicious PyPI package targeting Microsoft AutoGen and MCP users; overrides setup.py install command to exfiltrate AZURE_OPENAI_API_KEY and ~/.azure/accessTokens.json. Credited to Checkmarx Zero / Socket ↗

pypi:claudedashbord==0.1.0 (package, 2026-10-26) — Malicious code in claudedashbord (PyPI) Credited to Amazon Inspector ↗

pypi:claudedashbord==0.1.1 (package, 2026-10-26) — Malicious code in claudedashbord (PyPI) Credited to Amazon Inspector ↗

pypi:claudedashbord==0.1.2 (package, 2026-10-26) — Malicious code in claudedashbord (PyPI) Credited to Amazon Inspector ↗

pypi:claudedashbord==0.1.3 (package, 2026-10-26) — Malicious code in claudedashbord (PyPI) Credited to Amazon Inspector ↗

pypi:claudeopuseni==0.1.0 (package, 2026-10-26) — Malicious code in claudeopuseni (PyPI) Credited to Amazon Inspector ↗

pypi:claudeopuseni==0.1.1 (package, 2026-10-26) — Malicious code in claudeopuseni (PyPI) Credited to Amazon Inspector ↗

npm:[email protected] (package, 2026-10-26) — Malicious code in formatting-subtitles-for-claude (npm) Credited to Amazon Inspector ↗

npm:[email protected] (package, 2026-10-26) — Malicious code in formatting-subtitles-for-claude (npm) Credited to Amazon Inspector ↗

npm:[email protected] (package, 2026-03-31) — Verified clean build of axios published prior to the March 31, 2026 maintainer account hijack. Contains no install lifecycle hooks and no dependency on plain-crypto-js. Credited to threat.cafe Baseline Audit ↗

npm:[email protected] (package, 2026-04-01) — Verified remediated release of axios following revocation of compromised maintainer credentials and removal of [email protected]. Credited to threat.cafe Baseline Audit ↗

pypi:litellm==1.82.6 (package, 2026-03-25) — Verified clean PyPI wheel of LiteLLM prior to the March 24, 2026 TeamPCP compromise. Contains zero .pth startup files in wheel archive. Credited to threat.cafe Baseline Audit ↗

pypi:litellm==1.82.9 (package, 2026-03-25) — Verified clean PyPI release of LiteLLM published after PyPI token rotation and removal of litellm_init.pth. Credited to threat.cafe Baseline Audit ↗

npm:[email protected] (mcp, 2025-09-27) — Verified build of postmark-mcp prior to the 1.0.16 covert BCC injection. Sends email solely to caller-specified recipients via api.postmarkapp.com. Credited to threat.cafe Baseline Audit ↗

npm:@modelcontextprotocol/[email protected] (mcp, 2026-01-15) — Official reference MCP filesystem server. Enforces directory allowlist passed via CLI arguments; contains no network egress or install hooks. Credited to threat.cafe Baseline Audit ↗

npm:@modelcontextprotocol/[email protected] (mcp, 2025-07-01) — Patched release of Official MCP Inspector enforcing cryptographic session token authentication and Origin header validation on localhost proxy. Credited to threat.cafe Baseline Audit ↗

npm:[email protected] (mcp, 2025-07-10) — Patched release of mcp-remote sanitizing OAuth authorization_endpoint URLs to strictly enforce https:///http:// schemes and prevent shell command injection. Credited to threat.cafe Baseline Audit ↗

npm:@mcpjam/[email protected] (mcp, 2026-04-12) — Patched release of MCPJam Inspector binding strictly to 127.0.0.1 with mandatory bearer token authentication. Credited to threat.cafe Baseline Audit ↗

pypi:langflow==1.0.15 (package, 2026-05-03) — Patched release of Langflow requiring authentication and sandboxing on code validation endpoints. Credited to threat.cafe Baseline Audit ↗

gh:openclaw/[email protected] (package, 2026-03-23) — Patched OpenClaw release remediating CVE-2026-25253 through CVE-2026-33579 with mandatory gateway token isolation, pairing nonce validation, and SSRF/path-traversal guards. Credited to threat.cafe Baseline Audit ↗

skillssh:vercel-labs/agent-skills/web-design-guidelines (skill, 2026-10-25) — Verified clean instructional skill from vercel-labs/agent-skills. Pure Markdown design guidelines with zero shell execution, zero credential prompts, and zero external script fetches. Credited to threat.cafe Baseline Audit ↗