Malicious packages, on record.

The install hook performs concrete global AI-agent configuration and lifecycle mutations, exceeding package-local setup. Runtime LLM networking is not needed for the block decision.

Source inspection confirms an automatic postinstall chain that modifies global Claude/Codex configuration and registers a Node notify hook. This meets the blocking policy for unconsented...

Source inspection confirms install-time replacement of the global `codex` command rather than ordinary package-local setup. No exfiltration was found, but the concrete CLI hijack meets th...

The automatic postinstall writes a persistent Claude Desktop MCP command without user invocation or consent. This meets the install-control-surface blocking criterion regardless of the pa...

Source confirms concrete postinstall persistence into ~/.claude/skills and ~/.claude/agents plus runtime npm installation. This meets the install-control-surface block policy.

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking poli...

Direct source inspection confirms an unconsented postinstall write to global AI-agent skill locations. Collision checks reduce overwrite risk but do not remove the foreign control-surface...

Source inspection confirms the policy-defined blocking behavior: unconsented postinstall mutation of global Claude Code and Codex MCP configuration. The explicit CLI-only hook installer d...

The package has a concrete postinstall chain that mutates foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface...

The package performs unconsented postinstall mutation of user-global and arbitrary project Claude Code configuration. The guardrails do not remove the broad install-time control-surface w...

Source directly implements covert profile collection and account sweeping, coupled to permission-bypassing AI-agent command execution and platform synchronization. Absence of npm lifecycl...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, meeting the blocking policy. The declared vision feature does not remove the lifecycle-control r...

Source directly confirms a postinstall write into ~/.claude/skills and an agent-directed shell-execution payload. This meets the policy boundary for an unconsented lifecycle mutation of a...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. Lack of exfiltration does not remove the install-time agent-control hijack behavior.

The package’s global postinstall directly triggers persistent Claude Code hook injection and daemon startup. This meets the block policy for unconsented install-time mutation of a foreign...

The package performs unconsented postinstall installation of a third-party AI-agent CLI and persistent user-environment changes. This meets the install-time foreign AI-agent control-surfa...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. The absence of exfiltration does not remove that install-time control-surface risk. Product guar...

This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, compounded by mutable remote instruction retrieval. It meets the blocking policy even thoug...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and incorporates remote instruction content. This meets the blocking policy despite no co...

This is a concrete unconsented postinstall mutation of a shared upstream AI-agent control surface, meeting the blocking policy. No source evidence of network exfiltration was found, but i...

The concrete postinstall behavior mutates broad foreign AI-agent configurations and introduces a remotely resolved MCP execution path. This meets the block boundary regardless of the abse...