Malicious packages, on record.

Direct source inspection confirms unconsented postinstall mutation of global Claude and Codex controls, including executable lifecycle configuration. This meets the blocking policy regard...

The install hook performs concrete global AI-agent configuration and lifecycle mutations, exceeding package-local setup. Runtime LLM networking is not needed for the block decision.

Source inspection confirms an automatic postinstall chain that modifies global Claude/Codex configuration and registers a Node notify hook. This meets the blocking policy for unconsented...

Source inspection confirms install-time replacement of the global `codex` command rather than ordinary package-local setup. No exfiltration was found, but the concrete CLI hijack meets th...

This is concrete install-time delivery and persistence of a native executable with explicit security-control bypass behavior. The bundled checksum provides integrity only relative to the...

The automatic postinstall writes a persistent Claude Desktop MCP command without user invocation or consent. This meets the install-control-surface blocking criterion regardless of the pa...

Source confirms concrete postinstall persistence into ~/.claude/skills and ~/.claude/agents plus runtime npm installation. This meets the install-control-surface block policy.

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking poli...

The advertised server utility embeds an undisclosed global install and stealthy background process launch to a remote API. Although it is runtime-triggered rather than npm lifecycle-trigg...

The package embeds an undisclosed external script and an obfuscated fetch-plus-new-Function loader activated by opening its page. This is a concrete remote code execution surface, not mer...

The source documents and implements an install-time unsigned native payload delivery chain designed to avoid OS security warnings. Bundled checksum validation does not negate the intentio...

Direct source inspection confirms an unconsented postinstall write to global AI-agent skill locations. Collision checks reduce overwrite risk but do not remove the foreign control-surface...

This is concrete runtime data exfiltration, not merely a capability library: clipboard transmission starts automatically when the CLI runs. The absence of an install hook limits install-t...

Runtime execution automatically exfiltrates arbitrary clipboard changes to a remote endpoint and provides screenshot upload through a stealth interface. The absence of lifecycle hooks lim...

The package embeds a concealed, cryptographically gated decrypt-and-spawn chain in its primary Mutex implementation. This is concrete malicious runtime behavior, not an unused static prim...

The package performs concealed import-time remote payload execution unrelated to its declared text-helper functionality. This is concrete malware behavior.

This is an unconsented install-time collection and exfiltration chain targeting the consuming project's .env, with an intentionally hidden destination and silent failure handling.

The source directly constructs a set of environment-secret values and uploads it automatically to a fixed external host. This is credential exfiltration, irrespective of the absence of in...

Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious pr...

This is concrete credential exfiltration to a fixed third-party endpoint, not required for normal Facebook session emulation. The copied example additionally opts into installing a foreig...

This is concrete credential and telemetry exfiltration to a fixed unofficial plaintext endpoint, despite requiring user-invoked setup. No lifecycle hook is needed for the harmful chain on...