npm security reports, with evidence.

Inspected source proves automatic shell-based reconnaissance and transmission of host data to a fixed unrelated recipient. The empty default entrypoint and absence of install hooks limit...

Inspected source proves automatic host-data collection and external transmission when the registry script loads. The manifest provides a loading route, making this concrete data exfiltrat...

Inspected source proves immediate reconnaissance and external data exfiltration unrelated to popover positioning. The inert default entrypoint limits activation but does not neutralize th...

Inspected source establishes automatic reconnaissance and data exfiltration unrelated to CSS positioning functionality. The absence of install hooks limits the trigger but does not neutra...

Inspected source proves executable host-data exfiltration unrelated to a CSS polyfill. The empty default entrypoint limits activation but does not neutralize the published registry payloa...

Inspected source establishes automatic system reconnaissance and data exfiltration unrelated to CSS polyfill functionality. The registry payload is executable on load, despite the absence...

Inspected source proves automatic system-data exfiltration upon loading the published registry module, unrelated to CSS field sizing. The payload is executable attack code, although ordin...

Inspected source establishes automatic host-data collection and transmission upon registry-module loading. The empty default entrypoint limits activation but does not neutralize the execu...

Source proves unconsented npm postinstall mutation of the foreign Hermes agent control surface, meeting the blocking policy. Backups and platform checks limit data loss but do not authori...

Source confirms unconsented postinstall mutation of a foreign, broad AI-agent control surface, meeting the blocking policy. Preserving existing configuration and verifying bundle signatur...

Inspected source establishes automatic mutation of OpenCode's shared control surface, including enabled third-party commands, rather than setup confined to a package-owned extension. This...

Inspected source proves unconsented postinstall mutation of broad and foreign AI-agent control surfaces. This meets the supplied blocking policy independently of scanner similarity labels...

Source proves automatic, unconsented account mutation directed by a remote channel list, with muting that suppresses notifications. This concrete attack supports blocking independently of...

Source proves automatic, remotely directed account manipulation through the active socket entrypoint. The benign lifecycle and media-processing findings do not explain or neutralize this...

Source inspection establishes concealed, automatic account actions directed by a remote channel list. This is concrete unauthorized account manipulation, supporting a malicious verdict in...

Inspected source proves automatic host-data collection and transmission in a distributed registry module. This is concrete data exfiltration, despite the absence of install hooks and the...

Inspected source implements concrete data collection and transmission unrelated to accessibility management. The attack activates when the registry asset is evaluated, despite the absence...

Inspected source establishes unconsented postinstall mutation of a broad, foreign AI-agent control surface. This meets the explicit blocking policy regardless of the skills' package-relat...

The inspected lifecycle chain performs unconsented, forced writes across foreign AI-agent instruction surfaces. Package-specific skill names do not neutralize this broad automatic mutatio...

Source proves unconsented postinstall mutation of multiple foreign AI-agent control surfaces. Package-branded skill names do not remove the broad installation-time mutation covered by the...

The inspected lifecycle chain automatically invokes broad AI-client configuration without a consent step, meeting the install-time agent control-surface blocking policy. The native implem...