npm security reports, with evidence.

The postinstall hook copies Claude Code skills into a consumer project's .claude/skills directory without an explicit setup command, which is unconsented mutation of a foreign AI-agent co...

The postinstall hook copies skills and agents into consumer .claude and .agents paths and writes Copilot instruction and hook files, which is unconsented mutation of foreign AI-agent cont...

The package performs the policy-defined malicious chain: automatic postinstall mutation of foreign AI-agent controls plus detached persistence. Its stated safety purpose does not establis...

The automatic postinstall chain performs broad SSH and system mutations, including remote authorized-key installation and persistent background services. This is concrete install-hook abu...

This is an unconsented postinstall mutation of a consumer AI-agent control surface, including recursive deletion of existing configuration. The lifecycle behavior meets the install-hook a...

The postinstall hook mutates Claude Code's user settings file and turns on remote logging of prompts and replies without consent. That is unconsented install-time hijack of a broad agent...

This is an unconsented install-time system modification with privileged command attempts, not ordinary dependency setup. The repeated startup path increases the persistence of that behavior.

postinstall rewrites user-global Claude Code settings and enables prompt, reply, and tool telemetry to otel.togaiq.com, including on installs that never open a project. That is unconsente...

Source shows an automatic postinstall that mutates Claude Code and Codex control-plane files, which is unconsented foreign agent-surface hijack. The MCP payload is first-party, but that d...

The package contains concrete cryptocurrency transaction signing and transfer logic routed through a fixed gateway with hard-coded fee accounts. Although execution is command-triggered ra...

The npm postinstall hook writes karajan-mcp into Claude Code and Codex user configs without consent. That is unconsented mutation of a foreign AI-agent control surface, so the package is...

postinstall silently mutates the user's global Claude Code settings and turns on remote export of session prompts, replies, and tool traces. That is unconsented foreign agent-control-surf...

This package has no functional code but uses two unconsented automatic lifecycle hooks to exfiltrate host and CI information. The behavior is concrete install-time data collection and war...

This is concrete, unconsented install-time host data exfiltration with no corresponding package functionality. It is malicious install-hook abuse.

This package has no functional implementation but automatically exfiltrates host and CI-related metadata at install time. The behavior is concrete, unconsented, and unrelated to a legitim...

OpenSSF Malicious Packages via OSV confirms strapi-plugin-osag@3.6.8 as malicious (MAL-2026-16235): Malicious code in strapi-plugin-osag (npm)

OpenSSF Malicious Packages via OSV confirms strapi-plugin-os-rec@3.6.8 as malicious (MAL-2026-16234): Malicious code in strapi-plugin-os-rec (npm)

The automatic lifecycle hook mutates a foreign, broad AI-agent control surface and installs behavior-bearing commands. This meets the install-control-surface blocking policy despite the c...

This is concrete, unconsented install-time host-data exfiltration to a fixed external endpoint. The inert JavaScript file does not mitigate the lifecycle-hook behavior.

Automatic, silent transmission of globally captured application logs to an unrelated endpoint is concrete data exfiltration. The benign workspace-only postinstall hook does not mitigate t...

This is a concrete unconsented postinstall mutation of foreign AI-agent configuration and hooks through an opaque native executable. That meets the install-control-surface blocking policy...