npm security reports, with evidence.

This is concrete install-hook abuse and credential exfiltration, not merely a user-invoked account-management tool: the global lifecycle hook changes broad AI CLI control surfaces and the...

The automatic postinstall mutates a foreign, user-wide AI-agent configuration and registers an opaque executable for later execution. This meets the install-control-surface blocking polic...

This is an unconsented postinstall mutation of the user's Cursor MCP control surface, combined with automatic skill deployment and remote binary retrieval. Integrity checks on the downloa...

The package has a registry install lifecycle hook that automatically fetches and writes agent instructions across unrelated global tool directories. That concrete control-surface mutation...

The package combines an automatic lifecycle mutation with remote-directed installation of another release of itself. This is a concrete install-hook self-dependency chain with persistent...

This is an automatic install-time write to foreign AI-agent control surfaces, not an explicit user setup action. The postinstall chain and the behavior-bearing copied skill satisfy the in...

The automatic lifecycle chain executes opaque native code and installs hooks into external AI-agent integrations. That concrete install-time control-surface mutation meets the publish-blo...

The fixed private endpoint, default credential, automatic tracing initialization, and POST export behavior establish a concrete runtime data-exfiltration mechanism. The absence of an inst...

The package contains an automatic install-time persistence action and a bundled skill that directs agents to install arbitrary remote skill packages over existing skills. The latter estab...

The automatic lifecycle chain installs agent hooks and includes an unsafe Codex launch configuration. This is concrete AI-agent control-surface abuse, not merely a user-invoked CLI feature.

The executable's fixed remote default and credential POST conflict with the documented localhost default. This is concrete credential-exfiltration behavior, even though it is triggered by...

The package automatically changes a foreign consumer project and persists its own lifecycle execution. The behavior is concrete in source and exceeds a user-invoked setup tool or a narrow...

The package has a concrete automatic postinstall chain that writes agent skills into both Codex and Claude user homes and performs a user-level pip installation. This meets the install-ho...

The source implements a deliberate sandbox escape through launchd and is paired with an automatic install hook. Token gating limits exposure but does not neutralize the permission-bypass...

Source establishes a credential-exfiltration path from a supported API-key CLI option to default third-party telemetry. No install lifecycle hook is present, but that does not remove the...

This is concrete automatic install-hook abuse: it modifies a foreign consumer's package lifecycle and agent tooling, then retries changes after the installer exits. The absence of observe...

This is an unconsented install-time mutation of foreign AI-agent instruction directories. The lifecycle hook directly performs the change and suppresses errors, making it concrete install...

The automatic lifecycle hook downloads or executes an opaque native binary and invokes agent-hook installation without an explicit setup command. That is concrete unconsented postinstall...

The automatic lifecycle hook installs package-authored instructions into multiple foreign AI-agent directories and has a generic fallback. This meets the install-time AI-agent control-sur...

This is an automatic postinstall mutation of a foreign, broad AI-agent control surface. The conditional binary lookup does not establish user consent and the installer suppresses failures.

The postinstall hook performs broad AI-agent and shell configuration mutation automatically. Although no separate exfiltration endpoint was found, this concrete install-time control-surfa...