npm security reports, with evidence.

The package contains concrete, automatic destructive behavior against containers it does not own. The narrow name filter does not establish ownership or consent.

The package performs unconsented postinstall mutation of foreign, broad AI-agent control surfaces, meeting the blocking lifecycle policy.

This is concrete install-hook abuse: an npm postinstall reaches package code that writes AI-agent configuration and execution hooks into the consumer repository. The absence of observed n...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, including destructive replacement of skill directories and automatic Codex plugin enablement. It meets th...

The bundled runtime contains an active, default-enabled AI control prompt that compels package-selected tool use and suppresses transparent assistant behavior. Although the outer client r...

The package has a concrete automatic lifecycle path that writes behavior-bearing files into foreign, broad AI-agent control surfaces. Although no network or credential sink appears in the...

The active command contains explicit hidden elevation, antivirus exclusion, security-policy disablement, remote binary download, and execution. These actions are unrelated to normal CLI i...

The automatic lifecycle hook performs destructive credential/configuration changes and account provisioning outside an explicit user command. This is concrete install-hook abuse, not ordi...

The automatic postinstall and startup paths execute privileged system mutations and unpinned tooling without an explicit user command. The behavior is concrete install-hook abuse, not mer...

The automatic lifecycle hook changes a foreign AI-agent control surface and persistent user environment. This is concrete install-hook abuse, not an explicit user-invoked setup action.

Runtime source establishes a complete default data-forwarding path to embedded external webhooks. The absence of install hooks limits the behavior to application runtime but does not remo...

The automatic postinstall hook writes package-controlled agent skills into the consumer project's .agents tree. This meets the install-control-surface blocking policy regardless of the op...

The package contains a default-on, hardcoded external logging channel that sends application data without requiring the consumer to provide the destination. This is concrete data exfiltra...

The package contains an automatic, hard-coded production session recorder that captures network payloads and transmits them to a remote vendor endpoint. Header filtering does not prevent...

The automatic postinstall hook mutates two unrelated, user-level AI-agent control surfaces. This meets the blocking policy for unconsented lifecycle configuration changes.

This is concrete install-hook abuse: an automatic postinstall downloads and persists opaque executable code that the package later runs. Same-source checksum validation does not bind the...

The automatic lifecycle hook downloads and installs remotely controlled executables, then runtime code executes one of them. This is a concrete remote-code-execution supply-chain path, no...

This is unconsented post-install mutation of third-party AI-agent control surfaces through an opaque native binary. The automatic, quiet execution meets the install-control-surface blocki...

The package uses an automatic postinstall hook to install external system software, including privileged package-manager commands. That concrete install-hook behavior exceeds ordinary dep...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. It meets the install-control-surface blocking policy even though no secret exfiltration wa...

The automatic lifecycle hook mutates downstream package-manager configuration and installs package-controlled AI-agent instructions and skills into the consumer project. This meets the po...