npm security reports, with evidence.

The automatic lifecycle hook mutates the consumer project's Claude Code configuration area, including deletion and installation of skill instructions. This meets the install-control-surfa...

The package has a concrete automatic install-time exfiltration path, not merely a suspicious primitive. Its simple runtime export does not mitigate the lifecycle-hook behavior.

This is unconsented postinstall mutation of a broad AI-agent control surface, coupled with credentialed external data transmission. The documented feature purpose does not remove the auto...

The automatic cross-account sharing is concrete, undisclosed data disclosure behavior. The package also embeds AI-agent control instructions, reinforcing malicious intent.

Source directly establishes default routing of supplied Facebook credentials to a fixed third-party host. The absence of an install hook does not remove this runtime credential-exfiltrati...

Importing the package runs a packed dropper that collects host identity, talks over axios, and executes decoded code with Function and execSync. The Pino-looking docs and empty middleware...

The postinstall hook automatically writes branded skills into many third-party agent skill directories. That is unconsented install-time mutation of a foreign, broad AI-agent control surf...

Runtime defaults post Facebook email, password, and 2FA to a hardcoded unofficial host, and session recovery does the same when credentials are configured. The example config names a diff...

OpenSSF Malicious Packages via OSV confirms tailwindcss-form-utils@0.5.1 as malicious (MAL-2026-16263): Malicious code in tailwindcss-form-utils (npm)

OpenSSF Malicious Packages via OSV confirms tailwindcss-form-ui@0.5.1 as malicious (MAL-2026-16262): Malicious code in tailwindcss-form-ui (npm)

The install hook writes into the consumer .claude/skills directory, which is an unconsented foreign AI-agent control surface. That matches publish-block hijack even though the skill text...

The postinstall hook writes Claude Code skills into the installing project's .claude/skills directory without a user command. That is unconsented mutation of a foreign AI-agent control su...

This is a concrete remote code execution path in the package's exported runtime artifact, with no integrity control over the downloaded JavaScript. The absence of an npm lifecycle hook do...

The automatic postinstall hook reaches broad foreign AI-agent control surfaces and writes package-provided skills into them. This is concrete unconsented install-hook abuse even though th...

Default npm postinstall copies this package's skill pack into ~/.clawdbot/skills and force-links it into ~/.claude, ~/.codex, and ~/.agents without an explicit user command. That is uncon...

Source shows always-on silent fetches of account emails and JSON IMAP configs, including passwords, to rmf39.aaz.lt during normal runtime init. That is concrete credential exfiltration, n...

This package contains a concrete install-time remote payload replacement path, not a transparent local setup step. It changes executable package source and its manifest without user actio...

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-a@1.0.3 as malicious (MAL-2026-16248): Malicious code in kartykgithub-takedown-a (npm)

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-a@1.0.0 as malicious (MAL-2026-16248): Malicious code in kartykgithub-takedown-a (npm)

The published runtime combines automatic source-code uploads with broad credential forwarding to a remote endpoint. Although activation is user-invoked and not install-time, this is concr...

This is unconsented postinstall mutation of a broad AI-agent control surface, executed through opaque bundled native code. The opt-out does not establish prior consent for the default ins...