npm security reports, with evidence.

This is an automatic remote payload execution chain with no checksum or signature verification, compounded by quarantine removal. Although the host is package-aligned and no direct secret...

The automatic install hook deletes external user binaries and performs persistent machine tracking with remote transmission. This is concrete destructive behavior and data exfiltration un...

The package performs unconsented privileged operating-system package installation from postinstall and retries it on CLI startup. This is a concrete host-mutation attack surface despite n...

The automatic postinstall persists executable code into the user's global Claude Code settings rather than limiting setup to an explicit command or package-owned project directory. This m...

This is an automatic install-hook supply-chain mutation that imports an unverified external native payload into a consumer dependency. The explicit plugin commands do not mitigate the sep...

The automatic postinstall hook performs unconsented global installation of a foreign AI-agent CLI and persistent user-environment mutation. This is concrete install-hook abuse even though...

The package's automatic lifecycle hook persistently installs a wildcard Claude Code command hook in the consumer project. This meets the policy threshold for malicious install-hook abuse.

The package contains no automatic npm install hook, but its user-invoked authentication flow deliberately delegates Google credential collection to an unrelated GitLab Pages domain. This...

The automatic lifecycle hook broadly mutates foreign AI-agent control surfaces and registers package-owned command callbacks. This meets the install-hook abuse blocking policy despite no...

The install hook mutates broad, foreign AI-agent control surfaces and accepts remotely fetched instruction content. This is concrete unconsented install-hook abuse.

This is an unconsented postinstall path that downloads and executes opaque code to register across available agent harnesses and start a background process. Checksum verification limits r...

The automatic postinstall performs a concrete, in-place mutation of a foreign AI-agent host package. Anchor checks and backups do not establish consent for that lifecycle-time control-sur...

The source establishes automatic runtime collection and transmission of user repository metadata to an undisclosed private endpoint. The absence of an npm lifecycle hook limits the trigge...

The source establishes a complete automatic postinstall chain that overwrites executables owned by @openai/codex. Backup and hash checks do not mitigate the unconsented replacement of the...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, combined with automatic user-wide dependency installation. That satisfies the install-control-surf...

This is unconsented install-time host mutation with automatic privileged package-manager execution, and it persists as a retrying runtime behavior. It is not required for ordinary depende...

The fixed gateway receives a caller’s API credential at runtime, which is not necessary for a local investment utility and creates a concrete credential-exfiltration path. The package als...

This is unconsented postinstall mutation of a broad third-party AI-agent control surface. The automatic hook registration establishes persistent execution, so it meets the publish-block p...

This package contains an import-triggered detached remote-code loader, not the runtime utilities claimed by its manifest. The remote payload is executed with Node module access, creating...

The automatic lifecycle hook forcibly changes project-level Claude behavior, which is concrete install-hook abuse under the policy. No separate exfiltration is required for this blocking...

The automatic postinstall hook writes to user-wide OpenCode configuration and enables this plugin without an explicit setup action. That matches the policy's publish-block condition for u...