npm security reports, with evidence.

This is an unconsented install-time mutation of a broad AI-agent control surface through a remote, latest-version installer. The lifecycle implementation is also deliberately obfuscated.

This is an unconsented postinstall mutation of a foreign, broad AI-agent control surface. The lifecycle script silently installs unrestricted command hooks, which meets the install-hook a...

The package has a concrete automatic postinstall path that mutates foreign global AI-agent control surfaces. This meets the install-hook abuse blocking boundary despite the absence of dir...

The package deliberately forwards NPM bearer credentials and selected package data to an unrelated Worker during its advertised publishing flow. Although user-invoked and without install...

The opaque third-party proxy receives an npm credential and uploaded files, creating a concrete credential and data exfiltration path. The absence of install hooks does not remove this us...

The source implements concrete credential and package-data transmission to an unrelated endpoint. User interaction is required, but it does not make forwarding an npm bearer token and arc...

This is a concrete credential and data-exfiltration path through an undisclosed third-party proxy. It is user-triggered rather than install-time, but the token-routing behavior warrants b...

This is a concrete credential-exfiltration path disguised as an npm publisher, reinforced by an embedded NPM credential. The lack of lifecycle hooks does not mitigate the malicious behavi...

This is concrete credential and source-data exfiltration through an opaque third-party relay. User interaction does not make forwarding an npm bearer token to that host safe.

The package deliberately routes npm credentials and uploaded content through an opaque third-party endpoint. This is concrete credential and data exfiltration behavior despite requiring a...

The custom Worker receives both the npm bearer token and package payload during normal browser publishing, while an embedded credential increases immediate exposure. This is concrete cred...

The package implements a credential-harvesting proxy for npm publishing, with an embedded npm token as an additional severe indicator. User interaction is required, but the credential tra...

This is concrete credential and data exfiltration through a third-party endpoint during the advertised publishing flow. The absence of an install hook does not neutralize the user-trigger...

The third-party endpoint receives an npm bearer token and user-selected package contents under misleading registry-publishing status text. This is concrete credential and data exfiltratio...

The explicit click does not neutralize the embedded credential or the non-npm proxy receiving both the bearer token and upload data. This is concrete credential and data exfiltration beha...

The code intentionally routes npm credentials and upload data to an unrelated Worker in its normal browser path. This is concrete credential and data exfiltration, not a package-aligned d...

Source directly establishes transmission of an npm bearer token and selected file payload to a non-npm endpoint under the package author's control. The hardcoded npm-style token further s...

This is an unconsented postinstall mutation of broad, pre-existing AI-agent control surfaces. The conditional checks and opt-outs do not establish user consent.

Direct inspection confirms an automatic preinstall hook that fingerprints the host and exfiltrates the values over HTTP. This is concrete malicious install-hook abuse.

This is concrete, unconsented runtime data exfiltration from an AI coding agent to a package-controlled endpoint. No lifecycle hook is needed because the exposed CLI directly activates th...

The package performs an automatic postinstall chain that alters consumer configuration and installs package-controlled AI-agent instructions and skills. Its generated instruction explicit...