npm security reports, with evidence.

The package performs unconsented install-time mutation of a broad AI-agent control surface by installing a separate global Claude Code package, alongside persistent shell and launcher cha...

The default remote endpoint, all-site extension access, and credential upload form a concrete credential-exfiltration path. The broad local AI credential discovery adds further sensitive-...

This is concrete concealed install-hook abuse, not a user-invoked setup flow. The lifecycle hook triggers process creation, persistent user-home changes, and SSH activity without consent.

This is concrete, unconsented install-time host profiling and exfiltration to an unrelated external endpoint. The automatic lifecycle trigger and identity-command collection make the pack...

This is an automatic install-time host and identity-data exfiltration path with no package functionality that requires it. The empty runtime module does not justify the lifecycle behavior.

This is concrete, unconsented install-time system profiling and data exfiltration to an unrelated hard-coded endpoint. The empty runtime export does not justify the lifecycle behavior.

This is concrete, unconsented install-time collection and exfiltration of local host and account identity data. The lifecycle trigger and outbound HTTP behavior establish a malicious supp...

The automatic postinstall chain makes broad changes to a consumer project's AI-agent control surface and development configuration. The safeguards limit targets but do not provide consent...

This is unconsented install-time collection and exfiltration of host and user identity data to an unrelated external IP address. The empty runtime module provides no legitimate package fu...

The import-time loader combines remote payload execution, detached process creation, and self-removal. These behaviors are concrete malicious execution, even though npm lifecycle hooks ar...

The automatic postinstall hook modifies both Codex and Claude user configuration surfaces and adds user-level dependencies. This is concrete install-hook abuse rather than an explicit use...

The source directly contradicts the postinstall dry-run claim: the invoked helper takes its full server-start and SSH path. The deliberate concealment and automatic lifecycle execution es...

The package has a conditional automatic install hook that rewrites foreign AI-agent authentication and sandbox controls. This creates a concrete agent-control compromise even though no da...

The source directly transmits BYOK credentials to a fixed non-provider endpoint. The absence of install hooks limits the trigger but does not remove the credential-exfiltration behavior.

The package has a concrete automatic lifecycle path that mutates consumer AI-agent control surfaces and configures execution of another package. This meets the install-control-surface blo...

The hardcoded external logging endpoint receives serialized account configuration during normal initialization, including fields capable of holding IMAP passwords. This is concrete data e...

The shipped runtime contains a complete automatic path from account loading to silent third-party transmission of account metadata. This is concrete unconsented data exfiltration, not req...

This is a concrete import-time remote code execution chain concealed in unrelated glob-matching code. The absence of an install hook does not mitigate execution when an application import...

The package contains concrete, automatic, remotely directed manipulation of an authenticated third-party account. Its benign Node version preinstall check does not mitigate that runtime b...

The automatic postinstall hook mutates a user-wide OpenCode tool control surface by installing agent-callable code. This is a concrete install-hook abuse despite the absence of network ex...