npm security reports, with evidence.

The package explicitly implements targeted CSS command-and-control and exfiltration-marking requests against an administrative API. The lack of install scripts does not remove the malicio...

The package performs automatic postinstall rewrites of user Cursor and Codex MCP settings, alongside broad consumer-project mutation. This meets the blocking policy for unconsented lifecy...

This package is a disguised browser redirector with encrypted, server-selected payload delivery. The absence of npm lifecycle hooks does not neutralize the concrete malicious behavior exe...

The package embeds an active service-worker proxy application in an SVG declared as its npm entry point. Its automatic scope-wide request interception and externally configured traffic re...

The package has no npm lifecycle hook, but its declared main entrypoint performs unconsented browser-side persistence and ships an obfuscated remote loader. This is concrete malicious beh...

The postinstall hook automatically writes package content into global Claude and Codex agent directories. This concrete, broad agent-control-surface mutation meets the install-time blocki...

This is an unconsented postinstall mutation of broad foreign AI-agent control surfaces, combined with automatic remote native-code execution. It meets the install-hook abuse blocking policy.

The public library entry is benign, but the included t.js contains an executable, targeted account-takeover workflow. Its lack of automatic npm execution reduces exposure but does not neu...

This is a concrete remote AI-agent control channel: a default startup connection accepts server-directed skill replacement from arbitrary URLs. The absence of lifecycle hooks does not mit...

The advertised converter explains the feature but does not make automatic retrieval and execution of an unpinned opaque binary safe. This is concrete remote payload execution through an i...

This is concrete unconsented install-time persistence across operating systems, reinforced by deliberate process-name evasion. The absence of a self-dependency does not neutralize this li...

This is an unconsented install-time mutation of a broad AI-agent control surface. The automatic postinstall, disabled consent path, persistent global skill, hooks, and instruction changes...

The lifecycle hook performs broad, persistent Claude Code control-surface changes without user consent. This meets the install-hook abuse blocking policy even though the inspected path do...

The complete lifecycle path automatically and silently modifies global instruction files for three unrelated AI-agent tools, then injects directives that influence future sessions. This i...

The package contains a concrete automatic path that transfers workflow secrets to a fixed external service. Absence of an install hook does not remove the runtime credential-exfiltration...

This is an unconsented postinstall mutation of a foreign AI-agent control surface, with persistent automatic command execution. The existence checks limit targets but do not remove the in...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote executable delivery and privileged host configuration changes. The global-install gu...

The package covertly redirects Anthropic credentials to an unrelated remote service. No lifecycle hook is needed for this runtime credential-exfiltration behavior to warrant blocking.

The package has a concrete automatic postinstall path that modifies broad consumer AI-agent configuration and instruction files. This meets the install-hook abuse blocking policy even wit...

The package contains a concrete runtime path that extracts and transmits wallet private keys to a remote endpoint. This is credential exfiltration, not a necessary client-side transaction...

The source establishes a concrete credential flow to a fixed third-party host during runtime login recovery. Lack of an install hook does not mitigate the credential-exfiltration behavior.