npm security reports, with evidence.

The automatic postinstall chain mutates broad, foreign AI-agent control surfaces and launches persistent background indexing. This meets the install-hook abuse blocking policy even though...

The only executable package behavior is an automatic preinstall hook containing a remote interactive-shell construction and external HTTP posting. This is concrete install-time compromise...

The postinstall hook overwrites a global Pi agent instruction file rather than performing an explicit user-invoked setup. This meets the install-time AI-agent control-surface mutation blo...

The automatic postinstall path performs broad, unconsented mutation of foreign AI-agent control surfaces and installs persistent command hooks. This meets the install-hook abuse policy ev...

The automatic lifecycle hook installs a package-authored AI-agent control framework into and prunes the consumer project. Although the inspected path has no network or credential theft be...

The package has a concrete automatic install-time chain that writes broad AI-agent configuration and installs a command hook in the consumer project. This meets the install-hook-abuse blo...

The lifecycle hook creates and populates a consumer OpenCode configuration, including enabled npx-based MCP commands. That concrete automatic control-surface mutation meets the blocking p...

The package automatically injects enabled MCP commands into a consumer OpenCode workspace during postinstall. This is a concrete unconsented AI-agent control-surface mutation, so it meets...

The package embeds a reachable automatic account-mutation path controlled by a remote list. Its benign Node-version preinstall check does not mitigate that runtime behavior.

Source directly establishes automatic transmission of sensitive mail-account configuration to an external host. The limited workspace-only postinstall hook does not mitigate the runtime c...

This is a concrete, remote-controlled, unconsented action on an authenticated user account. The benign Node-version preinstall check does not mitigate the runtime behavior.

Source establishes a concrete, automatic external data-exfiltration path for account metadata and broad console content. The benign workspace-only postinstall hook does not mitigate the r...

Source directly establishes runtime transmission of user account metadata to a non-mail-provider endpoint. The benign workspace-only postinstall hook does not mitigate this concrete data-...

The package performs unconsented install-time host reconnaissance and external transmission. Its canary description does not remove the concrete data-exfiltration behavior.

The package deliberately detects AI-agent and sandbox context and transmits it by default during normal CLI use. Although there is no lifecycle hook, this undisclosed collection is a conc...

The source directly implements credential collection and transfer to a non-GitHub service. The lack of an install hook limits the trigger but does not remove the credential-exfiltration b...

This package deliberately disables and programmatically approves Claude Code safety controls, including a write to its global configuration. The behavior is concrete, automatic for sessio...

The package has a concrete automatic postinstall path that replaces skills across three user-home AI-agent control surfaces. The opt-out does not establish consent for the default install...

Although no install-time hook runs, the published MCP tools expose an active chain for credential attempts, license forgery, and privileged remote modification of arbitrary caller-selecte...

The sole package source defines an automatic preinstall reverse shell, which is direct malicious install-hook behavior.