npm security reports, with evidence.

Source shows an automatic postinstall that writes this package's skills into many third-party agent skill directories, which is unconsented mutation of a foreign and broad AI-agent contro...

The package automatically exports full traced URLs to a vendor endpoint while constructing URLs that embed bearer tokens. This is a concrete credential-exfiltration path, not ordinary use...

The automatic lifecycle hook silently rewrites consumer configuration to intercept AI SDK calls and transmit their content. This meets the install-hook abuse policy for a foreign AI-agent...

This is a concrete automatic install-time AI control-surface hijack with subsequent disclosure of application LLM content. The behavior meets the publish-block policy regardless of the pa...

Automatic postinstall execution of a native binary with --install-agent-hooks, together with the package's own statement that this writes Codex and Claude Code hooks and skills, is uncons...

This is a concrete install-time mutation of a consumer AI integration that enables collection and external reporting of LLM content. The behavior is automatic rather than an explicit user...

The package contains concrete automatic install-time data transmission rather than only user-invoked networking. The lifecycle path is transparent but unconsented and suppresses its netwo...

The package uses a registry-install lifecycle hook to alter two unrelated user-level agent configurations and install dependencies. This meets the policy threshold for malicious install-t...

The postinstall hook establishes or replaces skills across unrelated AI-agent products without an explicit user setup action. This meets the install-time foreign/broad AI-agent control-su...

The package contains a concrete server-directed arbitrary JavaScript execution path in customer web pages, alongside automatic host traffic and DOM collection. The absence of install hook...

The package executes automatic system-package installation, including sudo attempts, from its npm postinstall hook and repeats it at CLI startup. This is a concrete install-hook abuse rat...

The postinstall script rewrites OpenClaw's user config to allowlist this plugin, which is unconsented mutation of a foreign agent control surface. Workspace upload to api.xmem.space is th...

The postinstall hook writes this package's skill into Claude Code, Codex, and cc-switch skill directories without an explicit user setup command, which is unconsented mutation of foreign...

Postinstall automatically writes behavior-bearing Claude Code skills into the consumer project's .claude/skills directory, which is unconsented mutation of a foreign AI-agent control surf...

Automatic postinstall writes behavior-bearing files into the consumer's .claude/skills/ directory, which is a foreign Claude Code control surface. That matches unconsented install-time ag...

The published entrypoints contain concrete, import-time protestware that disables page interaction and fetches looping audio for targeted visitors. That is unconsented attack behavior in...

The published main module is only an import-time probe of secret and admin paths that posts their contents to /addPost. That is concrete data theft, so the package should be blocked even...

postinstall in package.json runs scripts/install.js, which fetches a native binary and then, when ~/.claude or ~/.codex already exists, executes install-hooks --all with no opt-in prompt....

The postinstall hook mutates the consumer OpenCode control surface and then applies a remote signed bundle onto the same paths. That is unconsented install-time hijack of a foreign AI-age...

The postinstall hook downloads and installs an unverified native binary from a raw IP with TLS verification disabled, then the CLI launcher executes it. That is a concrete unconsented ins...

postinstall automatically executes an opaque binary that writes Claude Code user config and registers global hooks, which is unconsented mutation of a foreign AI-agent control surface. Sc...