npm security reports, with evidence.

This is an unconsented postinstall mutation of a foreign AI-agent control surface, combined with persistent user-environment and launcher writes. The package therefore meets the install-h...

The package contains a runtime chain that automatically executes remotely supplied binaries, persists background services, and authorizes container-to-host SSH access. These capabilities...

The package has a concrete, automatic postinstall mutation of a global Claude Code skill directory and forcibly replaces its contents. This meets the install-control-surface blocking poli...

The automatic postinstall chain mutates Claude Code's control surface and installs an external plugin during npm installation. This is concrete unconsented install-hook abuse.

The source establishes a direct path from local third-party credential files to serialized remote state. This is concrete credential exfiltration beyond ordinary local CLI operation.

The automatic postinstall mutation of the consumer project's Claude skill directory meets the install-control-surface block policy. The absence of network activity does not neutralize the...

The default endpoint and Bearer authorization path establish concrete credential forwarding to a non-package-aligned host. This is sufficient for a publish block despite requiring an expl...

Automatic postinstall writes agent skills into the consuming project and can add remotely fetched skills. That is concrete unconsented mutation of a broad AI-agent control surface.

This is an unconsented install-time mutation of a foreign global AI-agent control surface. Integrity checks for the downloaded binary do not remove the risk created by automatic Cursor co...

The automatic lifecycle hook mutates foreign Claude Code and global Claude paths while installing unchecked remote artifacts. The runtime global self-update renews that install-hook path...

The package contains a complete server-driven remote shell execution path and an automatic forced self-update path with optional sudo. Its harmless install banners do not mitigate these r...

This is an unconsented install-time AI-agent control-surface action implemented through an opaque remotely fetched executable. Its automatic execution and fail-open verification create a...

This is concrete, automatic post-install mutation of a consumer project's broad AI-agent control surface, combined with persistent Git-hook execution. That meets the install-control-surfa...

The package has a concrete automatic postinstall path that modifies global AI-agent configuration and establishes future command execution. This meets the install-time AI-agent control-hi...

This is an automatic install-hook persistence chain with credential-accessing runtime behavior. The package mutates the user's agent execution environment and starts a long-running servic...

The install lifecycle automatically mutates foreign AI-agent hook surfaces, including Claude paths, through a nested package CLI invocation. The guards narrow when it occurs but do not pr...

The package performs automatic postinstall mutation of foreign, user-wide AI-agent settings and permissions. The lifecycle guard and lack of observed exfiltration do not remove the concre...

This package has a concrete install-time remote payload execution path. The same-origin checksum check does not constrain a compromised or substituted release response, so the automatic p...

The lifecycle hook establishes automatic persistence in a shared AI-agent directory and changes its configuration. Although no postinstall exfiltration was found, the concrete control-sur...

Source inspection confirms unconsented postinstall mutation of global Claude Code configuration and instructions. This meets the install-control-surface blocking policy even though no cre...

Source establishes credential collection and upload to a default endpoint inconsistent with the package's stated Happy identity. The explicit command trigger does not remove the misleadin...