npm security reports, with evidence.

OpenSSF Malicious Packages via OSV confirms kartyk-github-token-pkg@1.0.3 as malicious (MAL-2026-16246): Malicious code in kartyk-github-token-pkg (npm)

The automatic postinstall chain fetches and executes an opaque native payload, then targets pre-existing Claude or Codex configuration through install-hooks --all. This is a concrete unco...

postinstall writes a bundled agent skill into ~/.codex/skills and ~/.claude/skills, which is unconsented mutation of foreign AI-agent control surfaces. That matches a blocking install-tim...

The postinstall hook writes FocalAPI skills into many third-party agent skill directories under the user home without a separate user command. That is unconsented install-time mutation of...

The published main module is only an import-time fetch of /Profile followed by a POST of that body to /addPost, with no helper API. Combined with an empty manifest and no install hooks, t...

This package creates a concrete automatic supply-chain payload path by accepting and deploying an opaque remote native binary without certificate or integrity verification. The lifecycle...

The postinstall hook writes a packaged skill into Codex and Claude user skill directories without a user command, which is unconsented mutation of foreign AI-agent control surfaces. READM...

The automatic postinstall hook broadly modifies global AI-agent configurations, which meets the install-control-surface blocking policy. The accompanying remote binary download increases...

This package performs persistent SSH-access setup and background service startup from postinstall rather than an explicit user action. That is concrete unconsented install-hook abuse, eve...

OpenSSF Malicious Packages via OSV confirms kartyk-github-oidc-test-pkg@1.0.1 as malicious (MAL-2026-16244): Malicious code in kartyk-github-oidc-test-pkg (npm)

OpenSSF Malicious Packages via OSV confirms kartyk-github-oidc-test-pkg@1.0.2 as malicious (MAL-2026-16244): Malicious code in kartyk-github-oidc-test-pkg (npm)

The postinstall hook unconditionally deploys package-controlled, high-capability AI-agent profiles into a global user configuration directory. This is concrete unconsented install-time mu...

The automatic postinstall hook installs privileged package-authored agents into a foreign shared AI-agent configuration directory. This meets the blocking policy for unconsented lifecycle...

This is a concrete import-triggered remote code execution and persistence mechanism, not a package-aligned utility. The absence of an install hook does not mitigate execution on ordinary...

The published main file immediately exfiltrates browser cookies to webhook.site. That is concrete credential theft on import, not package-aligned network use.

This is malicious agent-control behavior combined with unconsented automatic mutation of the host configuration and dependency environment. The lack of an npm install lifecycle hook does...

The automatic postinstall rewrites Claude Code and Codex global MCP configs to launch this package's server, which is unconsented foreign agent-control mutation. Scanner similarity to a p...

src/index.js is an obfuscated Ethereum-backed dropper that evals and spawn-executes recovered code on plugin import, while the README, types, and repository metadata impersonate a Tailwin...

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

postinstall mutates Claude Code user settings and turns on remote logging of prompts, replies, and tool details. That is unconsented install-time hijack of a foreign agent control surface...

This is a concrete remote code execution path coupled to global AI-agent hook installation and instructions designed to suppress inspection. The absence of an npm lifecycle hook does not...