npm security reports, with evidence.

The postinstall hook unconditionally deploys package-controlled, high-capability AI-agent profiles into a global user configuration directory. This is concrete unconsented install-time mu...

The automatic postinstall hook installs privileged package-authored agents into a foreign shared AI-agent configuration directory. This meets the blocking policy for unconsented lifecycle...

This is a concrete import-triggered remote code execution and persistence mechanism, not a package-aligned utility. The absence of an install hook does not mitigate execution on ordinary...

The published main file immediately exfiltrates browser cookies to webhook.site. That is concrete credential theft on import, not package-aligned network use.

This is malicious agent-control behavior combined with unconsented automatic mutation of the host configuration and dependency environment. The lack of an npm install lifecycle hook does...

The automatic postinstall rewrites Claude Code and Codex global MCP configs to launch this package's server, which is unconsented foreign agent-control mutation. Scanner similarity to a p...

src/index.js is an obfuscated Ethereum-backed dropper that evals and spawn-executes recovered code on plugin import, while the README, types, and repository metadata impersonate a Tailwin...

This is a concealed remote code execution chain unrelated to a Tailwind forms plugin. The absence of install hooks does not mitigate execution on normal package import.

postinstall mutates Claude Code user settings and turns on remote logging of prompts, replies, and tool details. That is unconsented install-time hijack of a foreign agent control surface...

This is a concrete remote code execution path coupled to global AI-agent hook installation and instructions designed to suppress inspection. The absence of an npm lifecycle hook does not...

OpenSSF Malicious Packages via OSV confirms html-to-gutenberg@4.2.21 as malicious (MAL-2026-6359): Malicious code in html-to-gutenberg (npm)

The automatic lifecycle hook, self-dependency constrained to an older release, project environment access, and database authorization seeding form a concrete install-hook abuse chain. The...

Automatic postinstall rewrites the consumer's Claude Code user settings and enables remote logging of prompts, replies, and tool details. That is unconsented mutation of a foreign AI-agen...

The manifest-reachable CommonJS entrypoint loads dist/index.js, which sends supplied credentials to an unrelated hardcoded gateway. The absence of an install hook does not remove this run...

The source establishes an automatic, unpinned self-install chain into a remote sandbox and a lifecycle hook that persistently changes command execution and shell configuration. This match...

This is an unconsented postinstall mutation of a broad AI-agent control surface that enables external collection of sensitive Claude session content. The automatic global configuration ma...

postinstall copies this skill into Claude, Gemini, Codex, and Antigravity skill directories and, for Claude Code, injects a machine-wide SessionStart hook into user-level settings.json wi...

The postinstall hook copies Claude Code skills into a consumer project's .claude/skills directory without an explicit setup command, which is unconsented mutation of a foreign AI-agent co...

The postinstall hook copies skills and agents into consumer .claude and .agents paths and writes Copilot instruction and hook files, which is unconsented mutation of foreign AI-agent cont...

The package performs the policy-defined malicious chain: automatic postinstall mutation of foreign AI-agent controls plus detached persistence. Its stated safety purpose does not establis...

The automatic postinstall chain performs broad SSH and system mutations, including remote authorized-key installation and persistent background services. This is concrete install-hook abu...