npm security reports, with evidence.

The default socket path includes a hidden delayed fetch of a maintainer-controlled channel list and an automatic follow loop against the user's WhatsApp session. That is unconsented accou...

The postinstall hook writes Claude Code skills into the consumer project's .claude/skills directory without a user command, which is unconsented mutation of a foreign AI-agent control sur...

postinstall mutates a foreign Claude Code skill directory in the consuming project without a user command, which is unconsented agent-control-surface hijack. Skill text looks product-rela...

Postinstall automatically runs a compiled binary that writes this third-party package's hooks and prompts into Claude Code's user directories, a foreign machine-wide agent control surface...

OpenSSF Malicious Packages via OSV confirms test8999-auth@1.0.1 as malicious (MAL-2026-16286): Malicious code in test8999-auth (npm)

OpenSSF Malicious Packages via OSV confirms test899-auth@1.0.1 as malicious (MAL-2026-16285): Malicious code in test899-auth (npm)

The install hook downloads and installs an unverified native binary from a raw IP while disabling TLS checks, which is a concrete remote payload dropper. The launcher then executes that b...

Source shows an unconsented npm postinstall write into Claude Code's project hooks.json with a wildcard PreToolUse command. That is a foreign, broad agent control-surface mutation and mee...

postinstall runs install/install.mjs --yes and writes OpenCode plugins, agents, skills, and config, plus global npm installs, without a user setup command. That is unconsented mutation of...

The only shipped behavior is an automatic postinstall that reads /tmp/flag.txt and sends it to an attacker-controlled ngrok URL. That is unconsented install-time data theft, not a develop...

The postinstall hook unconsented-writes Copilot, Claude Code, and Cursor control files in the consumer project and also weakens pnpm script gating via .npmrc. That is foreign and broad AI...

The published main entrypoint is a default-on harvester that sends cookies and scraped application flags to a hardcoded webhook.site URL. That is concrete exfiltration, so the package is...

OpenSSF Malicious Packages via OSV confirms @shared-web/assets@9.9.10 as malicious (MAL-2026-16283): Malicious code in @shared-web/assets (npm)

This is concrete security-control tampering paired with unverified remote binary execution, not a necessary transparent CLI bootstrap. The absence of an install hook limits the trigger to...

The explicit Windows registry modification disables a protective control, and the CLI then executes unverified remote binaries with inherited environment variables. The lack of an install...

The bundles implement concrete cross-site profile harvesting and exfiltration, including Google account data, despite being presented as a lightweight analytics script. Absence of an inst...

This package contains concrete host-security weakening and concealed elevation in its user-invoked command path. The absence of an install hook does not neutralize this malicious runtime...

The package contains concrete import-time collection and external transmission of browser cookie and profile data. The absence of lifecycle hooks does not mitigate this runtime exfiltrati...

The package contains a direct, import-time profile-data transfer to an unrelated fixed endpoint. There is no legitimate package functionality or consent mechanism present in the inspected...

The package's sole entry contains direct authenticated data collection and third-party exfiltration. Absence of an install hook does not mitigate the import-time browser attack.

Source inspection confirms automatic credential and application-data collection with exfiltration to a fixed third-party endpoint. The lack of install hooks does not mitigate the maliciou...