npm security reports, with evidence.

The package has a concrete automatic lifecycle chain that silently changes foreign AI-agent configuration and tool controls. This meets the install-control-surface blocking policy.

The reachable CLI sends API credentials to an unrelated default endpoint, which is concrete credential exfiltration behavior. The absence of an install hook does not remove the runtime ex...

This is an unconsented postinstall mutation of a foreign consumer project's application and build control surface, with persistence through a package-injected plugin. The behavior meets t...

The command entrypoint contains explicit, elevated security-control tampering followed by remote binary execution. This is concrete malware behavior even though it is triggered by CLI use...

The package installs a default external log receiver and transmits serialized application records to it. This is concrete data exfiltration behavior, despite the absence of an install lif...

The automatic postinstall chain mutates another vendor's Codex executable paths with opaque native binaries. This meets the install-control-surface blocking boundary despite its backup an...

The automatic postinstall hook persists a wildcard command into the consumer's Claude configuration. This meets the install-time AI-agent control-surface abuse blocking policy.

The package has a concrete, automatic postinstall chain that installs a foreign agent CLI and modifies persistent shell configuration. That exceeds package-local setup and meets the insta...

The complete automatic lifecycle path downloads remote content and writes it into broad AI-agent directories, while also deleting local agent-related state. This is concrete install-hook...

The fetch-to-new-Function chain is concrete and reachable through an unvalidated message event. Although there is no install hook, the runtime behavior warrants blocking.

The automatic postinstall deploys an opaque bundled binary and injects it into Pi's shared MCP configuration. This meets the policy threshold for unconsented install-time mutation of a fo...

The automatic postinstall chain persistently modifies ~/.claude and registers package commands as Claude Code hooks without an install-time consent gate. This meets the install-control-su...

This is a concrete postinstall control-surface mutation chain, not merely an explicit setup command. The automatic writes to Claude Code settings and package-controlled skill meet the ins...

The package performs automatic remote code execution during postinstall and uses the resulting opaque binary to modify Claude Code hooks and settings. This is a concrete install-hook abus...

This is an unconsented postinstall chain that executes a mutable remote payload and mutates an AI-agent control surface. The combination is concrete install-hook abuse rather than ordinar...

The automatic lifecycle hook performs broad global AI-agent configuration changes rather than limiting setup to an explicit command or package-owned location. This meets the install-contr...

The package contains a reachable automatic remote-code execution path: curl output from a package-controlled endpoint is piped to sh. The lack of an npm install hook does not mitigate exe...

This is an unconsented postinstall mutation of a foreign AI-agent executable surface. The package transparently performs the replacement, but it supplies opaque native payloads that take...

The lifecycle script performs a global foreign AI-agent installation and persistent shell mutation without requiring an explicit user setup command. This meets the install-control-surface...

The package contains a concrete default runtime data-export path to an external webhook, including arbitrary log payload and context fields. The absence of an install hook limits the trig...

A hard-coded external endpoint receives account credentials through an automatic recovery path. The absence of an install hook does not mitigate this concrete runtime credential-exfiltrat...