Detonation LabsBehavioral security for the AI agent supply chain

DBPublic database

Every public detonation, with its evidence.

Each package we detonate publicly is listed here with its full report. Search before you install.

16
reports
1
malicious
2
suspicious
7
no malicious behavior

6 results · newest first

PackageVerdictTop findingConfidenceScanned
span-mcppypi Could not run Nothing malicious or suspicious observed — 26 Oct 2026 @faapi/mcpnpm 7.6.0 Could not run Nothing malicious or suspicious observed — 25 Oct 2026 prepublish-mcpnpm 1.0.3 Could not run Nothing malicious or suspicious observed — 25 Oct 2026 prepublish-mcpnpm 1.0.3 Could not run Nothing malicious or suspicious observed — 25 Oct 2026 create-vagejsnpm 0.5.0 Could not run Nothing malicious or suspicious observed — 25 Oct 2026 lumi-trades-mcpnpm 0.9.7 Could not run Nothing malicious or suspicious observed — 25 Oct 2026

"No malicious behavior observed" reports observed behavior only. It does not prove a package is safe.