npm security reports, with evidence.

The fixed xAI TTS request forwards the active runtime credential without ensuring it is an xAI credential. This is concrete credential exfiltration reachable from the package CLI.

This is a concrete automatic postinstall control-surface mutation, which meets the blocking policy. No network exfiltration was needed to establish the install-hook abuse.

This is unconsented postinstall mutation of a broad AI-agent control surface. The package's lifecycle hook establishes persistent future command execution and global agent instructions.

The automatic global OpenCode control-surface write is concrete and is coupled to package-supplied agents with privileged capabilities. Integrity checking of one downloaded binary does no...

The package performs unconsented postinstall mutation of a broad AI-agent control surface and registers persistent future-session commands. This meets the install-hook abuse blocking poli...

This is unconsented postinstall mutation of a broad, foreign AI-agent control surface. The package establishes persistent commands and global instructions, so it meets the blocking instal...

The package uses postinstall to configure global Claude Code behavior and instructions without user consent. This meets the blocking policy for install-time mutation of a broad foreign AI...

This is a concrete postinstall mutation of a broad third-party AI-agent control surface, not merely an explicit setup command. The absence of observed secret theft does not neutralize the...

This is concrete install-time data collection and exfiltration to a third-party endpoint. The lifecycle hook makes the behavior run without an explicit package API call.

This package has a concrete automatic postinstall chain that mutates multiple consumer-project AI-agent instruction surfaces. The absence of exfiltration does not remove the unconsented i...

The package contains concrete, automatically triggered exfiltration of local identity and host data to an unrelated beacon endpoint during its normal operation. The absence of an install...

The source implements concrete, automatic exfiltration of host identity and user design identifiers to an unrelated external analytics endpoint. The absence of an install hook reduces sco...

The automatic lifecycle chain executes an opaque native installer that modifies Codex and Claude Code integrations. This is concrete unconsented AI-agent control-surface mutation, so it w...

This is a concrete automatic install-time credential and data-exfiltration chain, not package-aligned setup. The benign runtime client does not mitigate the malicious lifecycle behavior.

The package contains a concrete import-time protestware payload that disrupts selected users and fetches unsolicited remote media. The lack of an install hook does not remove the runtime...

This is an unconsented postinstall mutation of a broad, foreign AI-agent control surface. The automatic hooks create recurring package execution and prompt/session influence, meeting the...

This is a concrete automatic install-hook abuse chain: lifecycle execution, opaque native payload execution, and mutation of foreign AI-agent integrations. The downloader has no integrity...

The automatic postinstall modifies global Claude Code hooks and instructions without interactive consent. That meets the policy boundary for malicious install-hook abuse despite the packa...

This is a concrete automatic credential-exfiltration path, not functionality required by the SDK entrypoint. The postinstall trigger makes it run without a user command.

The guarded global-install condition does not provide explicit consent for an npm lifecycle hook to install remote software and alter Codex plugin configuration. This is concrete install-...

The automatic postinstall path persistently mutates global Claude Code control files and registers future command execution without installation-time consent. This meets the install-hook...