npm credential and data exfiltration reports.

Source directly confirms password submission to a fixed external endpoint and redirection of the Codex runtime to that endpoint. The absence of lifecycle hooks does not remove the concret...

Source establishes a concrete runtime data-exfiltration path for personal mailbox metadata to an unrelated endpoint. The absence of lifecycle hooks does not mitigate this runtime behavior.

This is concrete unconsented data exfiltration through a hidden default remote transport, with an explicit environment-value harvesting path. The lack of install hooks does not mitigate t...

The concealed default remote sink and automatic upload of user application logs form a concrete, undisclosed exfiltration path. Lack of install hooks does not mitigate this runtime behavior.

The concealed default remote logging target and raw environment-value logging create a concrete unconsented data-exfiltration path. The absence of install hooks does not mitigate runtime...

The concealed default remote destination and automatic transmission of user log data form a concrete data-exfiltration path. No lifecycle hook is needed because the behavior activates dur...

Direct source inspection confirms automatic collection and Telegram upload of the importing process's working directory. This is a concrete credential/data-exfiltration chain, not a benig...

This is not a lifecycle-only concern: executable runtime code injects broad file-harvesting instructions into a permission-bypassing AI agent. The lack of install hooks does not mitigate...

Despite its stated research purpose, the package automatically exfiltrates identifying build-environment data during installation through two network channels. This is concrete unconsente...

This is concrete, unconsented install-time host-data exfiltration disguised as a placeholder package. It warrants blocking.

The package has no apparent functionality beyond an unconsented install-time hostname beacon to an unrelated hard-coded endpoint. This is concrete data exfiltration behavior.

This is a concrete unconsented install-time network beacon that exports host identity to an unrelated hard-coded endpoint. It has no stated package functionality beyond the placeholder RE...

This is concrete broad credential collection and remote transmission to a package-controlled cloud endpoint, not merely a required cloud feature limited to the project. The install hook a...

Direct source inspection found a concrete unsolicited postinstall network callback that fingerprints the installing host. This is malicious install-time data exfiltration, not a package-a...

The sole package file defines an automatic install-time callback that collects and transmits local environment and directory information to an unrelated webhook endpoint. This is concrete...

Direct manifest inspection confirms an unconsented install-time external callback carrying host identity. The stated research purpose does not remove the package's concrete attack behavior.

This is concrete, unconsented install-time host-identifying data exfiltration to an external callback endpoint. The minimal package contents do not reduce the confirmed lifecycle attack.

The only package file defines an automatic install-time external callback that fingerprints the installing host. This is concrete unconsented data exfiltration.

Source directly establishes default remote transmission of credentials and user-supplied code to api.stainless.com. No install hook is involved, but the runtime exfiltration is sufficient...

This is concrete persistent collection and exfiltration of sensitive local AI-agent transcript content to a package-controlled endpoint, activated by normal CLI use without a separate opt...

The package transmits authentication credentials and optional 2FA material to a hard-coded non-Facebook endpoint during normal recovery behavior. The absence of lifecycle hooks does not m...