Malicious packages, on record.

The lifecycle hook performs both remote content acquisition and broad global AI-agent configuration writes without an explicit setup command. This satisfies the install-time foreign/broad...

The install-time replacement of a broadly named Codex launcher is a concrete unconsented AI-agent control-surface mutation. No network or credential theft was found, but the launcher hija...

The source establishes a concrete automatic persistence and configuration-mutation chain in an upstream Grok home, not merely a scanner signature. Lack of direct exfiltration does not mit...

Concrete postinstall mutation of ~/.cursor/skills and ~/.cursor/mcp.json meets the block boundary for unconsented foreign AI-agent control-surface writes. Checksum validation does not mit...

Direct source inspection confirms unconsented postinstall mutation of global Claude and Codex controls, including executable lifecycle configuration. This meets the blocking policy regard...

The install hook performs concrete global AI-agent configuration and lifecycle mutations, exceeding package-local setup. Runtime LLM networking is not needed for the block decision.

Source inspection confirms an automatic postinstall chain that modifies global Claude/Codex configuration and registers a Node notify hook. This meets the blocking policy for unconsented...

Source inspection confirms install-time replacement of the global `codex` command rather than ordinary package-local setup. No exfiltration was found, but the concrete CLI hijack meets th...

The automatic postinstall writes a persistent Claude Desktop MCP command without user invocation or consent. This meets the install-control-surface blocking criterion regardless of the pa...

Source confirms concrete postinstall persistence into ~/.claude/skills and ~/.claude/agents plus runtime npm installation. This meets the install-control-surface block policy.

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking poli...

Direct source inspection confirms an unconsented postinstall write to global AI-agent skill locations. Collision checks reduce overwrite risk but do not remove the foreign control-surface...

Source inspection confirms the policy-defined blocking behavior: unconsented postinstall mutation of global Claude Code and Codex MCP configuration. The explicit CLI-only hook installer d...

The package has a concrete postinstall chain that mutates foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface...

The package performs unconsented postinstall mutation of user-global and arbitrary project Claude Code configuration. The guardrails do not remove the broad install-time control-surface w...

Source directly implements covert profile collection and account sweeping, coupled to permission-bypassing AI-agent command execution and platform synchronization. Absence of npm lifecycl...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, meeting the blocking policy. The declared vision feature does not remove the lifecycle-control r...

Source directly confirms a postinstall write into ~/.claude/skills and an agent-directed shell-execution payload. This meets the policy boundary for an unconsented lifecycle mutation of a...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. Lack of exfiltration does not remove the install-time agent-control hijack behavior.

The package’s global postinstall directly triggers persistent Claude Code hook injection and daemon startup. This meets the block policy for unconsented install-time mutation of a foreign...

The package performs unconsented postinstall installation of a third-party AI-agent CLI and persistent user-environment changes. This meets the install-time foreign AI-agent control-surfa...