npm security reports, with evidence.

The postinstall hook writes Claude Code skills into the consumer project's .claude/skills directory without a user command, which is an unconsented install-time mutation of a foreign agen...

OpenSSF Malicious Packages via OSV confirms sql-limit-enforcer@10.0.1 as malicious (MAL-2026-16151): Malicious code in sql-limit-enforcer (npm)

This package combines an automatic installation lifecycle hook with unconsented host package-manager and sudo attempts. It also harvests credentials from unrelated agent configuration for...

The package deliberately and silently exports account metadata and broad application logs to an external host during ordinary use. The install hook is not the attack, but the runtime tele...

This is a typosquat of the official Tailwind PostCSS plugin with a hidden SVG-comment loader. On plugin run it decodes and executes arbitrary JavaScript from project SVG files, which is c...

The package routes user-supplied Facebook credentials to a fixed unrelated gateway during standard login. No install hook is needed for this concrete credential-exfiltration behavior.

OpenSSF Malicious Packages via OSV confirms confx1789550882@1.0.0 as malicious (MAL-2026-16260): Malicious code in confx1789550882 (npm)

The main entrypoint is an import-time IIFE that hunts local flag and admin pages and POSTs the results to webhook.site. That is a complete exfiltration chain even without npm install hooks.

The main module is an import-time probe that hunts for flags and posts the responses to webhook.site. That is concrete exfiltration, not a legitimate package feature.

The declared entrypoint performs direct, unconsented data exfiltration to a fixed third-party endpoint. The absence of lifecycle hooks does not remove the import-time attack surface.

The package's import-time entrypoint exfiltrates profile content and diagnostics to an unrelated external webhook. The absence of an install hook does not mitigate this concrete runtime d...

index.js is a side-effecting import-time fetch that forwards remote profile data and errors to webhook.site, which is a concrete exfiltration sink rather than a library. Empty metadata an...

The only source file is an import-time fetch of /profile that posts the body or error details to webhook.site. That is concrete data exfiltration, not package-aligned networking.

Automatic postinstall copies FocalAPI skills into every detected third-party agent skills directory without an explicit connect command. That is unconsented mutation of a foreign and broa...

The only runtime code is an import-time steal of /profile posted to webhook.site, which is concrete data theft rather than a library. Empty metadata and a main entry that only performs th...

This is concrete runtime data exfiltration, not merely a network-capable chat API: received photo attachment URLs are silently forwarded to ImgBB. The lack of an install hook does not mit...

The automatic installation of a separate vendor's global AI-agent CLI and persistent host configuration mutation creates an unconsented foreign agent control surface. No self-dependency o...

This is a concrete automatic install-hook chain that downloads and executes unverified remote native code while modifying the user environment. The lifecycle hook obscures errors, increas...

OpenSSF Malicious Packages via OSV confirms idx_form_script@999.0.2 as malicious (MAL-2026-16243): Malicious code in idx_form_script (npm)

The automatic postinstall hook broadly mutates foreign AI-agent control surfaces, which meets the install-control-surface blocking policy. The absence of a JavaScript network request does...