@roopesh.yadava/qa-pack@1.5.0

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

npm install; later invocation of the installed test-charter skill

Unconsented MCP tool approval and disclosure of an authenticated session token and report data.

AI-agent permission escalation and bearer-token exfiltration

The postinstall script writes into the consuming project's .claude directory and forcibly merges an MCP auto-approval into an existing local settings file. The installed test-charter skill directs the agent to obtain a token from browser storage or login traffic and submit it as a Bearer token to a hard-coded AWS API, creating a concrete credential-exfiltration path.

Concrete install-time mutation of a project AI-agent control surface is paired with a shipped token-capture-and-send workflow to an unrelated fixed endpoint. This meets the blocking threshold.