npm security reports, with evidence.

OpenSSF Malicious Packages via OSV confirms strapi-plugin-osag@3.6.8 as malicious (MAL-2026-16235): Malicious code in strapi-plugin-osag (npm)

OpenSSF Malicious Packages via OSV confirms strapi-plugin-os-rec@3.6.8 as malicious (MAL-2026-16234): Malicious code in strapi-plugin-os-rec (npm)

The automatic lifecycle hook mutates a foreign, broad AI-agent control surface and installs behavior-bearing commands. This meets the install-control-surface blocking policy despite the c...

This is concrete, unconsented install-time host-data exfiltration to a fixed external endpoint. The inert JavaScript file does not mitigate the lifecycle-hook behavior.

Automatic, silent transmission of globally captured application logs to an unrelated endpoint is concrete data exfiltration. The benign workspace-only postinstall hook does not mitigate t...

This is a concrete unconsented postinstall mutation of foreign AI-agent configuration and hooks through an opaque native executable. That meets the install-control-surface blocking policy...

The package contains an import-time detached remote-code execution chain unrelated to its advertised utility purpose. This is concrete malicious behavior even without an npm lifecycle hook.

This is concrete credential exfiltration and remotely controlled code execution on import. The Base64 endpoint encoding further conceals the behavior.

This package performs consequential SSH key, remote authorized_keys, local SSH configuration, dependency-installation, and background-process changes automatically during npm installation...

The package performs an automatic postinstall download or execution of opaque native code and immediately uses it to install Codex and Claude Code hooks. This is concrete install-hook abu...

This is concrete install-time agent-control mutation, not merely an optional CLI feature. The opaque native payload and remote binary download make the resulting hook behavior unreviewabl...

The package's install hook automatically executes an unpinned remote native payload and mutates an agent-related user configuration through that payload. This is concrete install-time rem...

This is an unconsented postinstall mutation of a broad AI-agent control surface. The lifecycle path is concrete and sufficient for blocking under the policy.

The package contains a default-enabled remote execution path that transmits a runtime session value and request data to a hard-coded external endpoint. This is concrete credential and dat...

Automatic installation-time transmission of an environment credential is concrete credential-exfiltration behavior. The package contains no evidence that the installer independently conse...

The package has an automatic preinstall hook that sends an environment credential to a remote host. This is concrete credential exfiltration during installation, despite the absence of ot...

The automatic preinstall hook exports an environment credential over the network. The absence of payload execution does not remove the concrete credential-exfiltration surface.

The automatic lifecycle hook collects and transmits a credential, creating concrete install-time credential-exfiltration behavior. No broader payload, persistence, or filesystem mutation...

This is concrete automatic credential transmission at install time, and the purported validation does not cause installation to fail for invalid responses. The behavior is therefore crede...

The package contains a concrete automatic install-time host-fingerprinting callback to a third-party endpoint. Its simple runtime export does not justify or mitigate that behavior.

Source inspection confirms direct, automatic collection of sensitive browser data and transmission to an unrelated fixed endpoint. The absence of an install hook does not mitigate the mal...