npm security reports, with evidence.

Runtime login posts Facebook email, password, and 2FA to a hardcoded unofficial host instead of Facebook, including the default email/password path. That is a concrete credential-theft si...

The fixed external credential redirect is concrete runtime exfiltration behavior. The lack of an install hook limits the trigger but does not make the exposed behavior benign.

OpenSSF Malicious Packages via OSV confirms kartykgithub-takedown-a@1.0.2 as malicious (MAL-2026-16248): Malicious code in kartykgithub-takedown-a (npm)

Automatic postinstall writes a skill file into multiple foreign global AI-agent directories, which matches unconsented install-time agent control-surface hijack. The GitHub binary downloa...

The postinstall hook downloads a native binary and non-interactively runs arkcli +connect --refresh to auto-detect local agents and install skills into them. That is unconsented install-t...

The automatic postinstall hook persistently changes the user's command environment and starts a restartable user service without an explicit setup command. This is unconsented install-tim...

The postinstall script writes into ~/.codex/skills and ~/.claude/skills, which is unconsented install-time mutation of foreign AI-agent control surfaces. That matches a publish block even...

The executable entry point harvests browser page data and transmits flag-like values or markup without an application-facing API or stated purpose. This is concrete data exfiltration beha...

The postinstall script executes a native binary with --install-agent-hooks and the package text states that this writes Codex and Claude Code hooks, skills, and Codex settings. That is un...

Postinstall automatically executes a native binary with --install-agent-hooks, and the package says that writes Codex and Claude Code hooks, skills, and Codex update settings. That is unc...

The package has a concrete automatic postinstall chain that executes an opaque native hook installer against Codex and Claude Code configuration. This meets the install-time AI-agent cont...

Inspected source shows import-time localStorage token theft and a fetch POST with no legitimate widget code. That is concrete credential exfiltration, so the package is blocked.

The package contains a reachable remote-code execution path: it downloads and evaluates JavaScript at runtime. The absence of install hooks reduces install-time risk but does not remove t...

This is an unconsented install-time mutation of foreign AI-agent control surfaces combined with remote executable loading and broad host changes. The global-install gate and opt-outs do n...

The hard-coded remote destination receives an environment credential without a configurable or source-verifiable authorization boundary. Although activation is user-invoked and there is n...

The source establishes a complete remote-response-to-dynamic-execution path. Although it is not install-time behavior and appears product-related, executing service-supplied code in a con...

The package has a concrete automatic postinstall chain that modifies multiple third-party AI-agent skills directories and changes future agent routing. This meets the install-control-surf...

postinstall copies and prunes a skill tree into Codex and Claude user skill directories, which is unconsented mutation of foreign AI-agent control surfaces. README wording and opt-in skil...

The package contains a concrete credential-exfiltration path through a hard-coded remote logging endpoint. Absence of an npm lifecycle hook does not remove the runtime risk.

The hard-coded removal of a purported competitor is destructive behavior, and the automatic patch configuration deliberately disables multiple agent control protections. No install hook e...

index.js is an import-time localStorage thief that POSTs the dump to /addPost, with no legitimate helper surface. That is concrete client-side exfiltration, not a noisy network primitive.