npm security reports, with evidence.

The package contains concealed, automatic account manipulation and a remotely controlled target list. This is concrete malicious runtime behavior, not package-aligned setup.

The source establishes a default runtime path that sends serialized credential-bearing account configuration to an unrelated remote logging endpoint. This is concrete credential exfiltrat...

The package contains an automatic external logging path that sends email-account data and broadly captured diagnostics to a third-party host. Its limited workspace-link install hook does...

The runtime socket contains a concrete, remotely controlled, unconsented action on the consumer's authenticated WhatsApp account. The benign Node-version preinstall check does not mitigat...

The automatic postinstall hook deletes and replaces skills in Codex, Claude, and cc-switch directories. This is concrete install-hook abuse under the stated policy.

Visible source establishes automatic external transmission of licence and exception data. This is concrete data exfiltration, independent of the opaque binary components.

This package executes remotely supplied scripts during an unconsented npm lifecycle hook and installs an external runtime outside the package. Its CLI also implements detached automatic r...

This is an unconsented postinstall mutation of broad AI-agent control surfaces, including automatically executed hook commands. The global-install guard does not establish consent for mod...

The package has a concrete automatic postinstall chain that mutates broad, foreign AI-agent control surfaces. This meets the install-hook abuse blocking policy.

The automatic lifecycle chain executes mutable remote code and changes global tooling and skills without consent. This is concrete install-hook abuse, not merely user-invoked setup.

This is a concrete, unconsented install-hook abuse chain that broadly mutates and persistently controls consumer application files. No install-time exfiltration was found, but the destruc...

This is an unconsented install-time mutation of a consumer AI-agent control surface followed by interception and remote transmission of application AI content. It meets the publish-block...

The lifecycle hook automatically mutates multiple foreign AI-agent skill roots. This concrete unconsented install-time control-surface write meets the publish-block policy.

The install hook silently rewrites a consumer application's AI module resolution and causes captured AI content to be uploaded. The explicit CLI does not remove the risk because the posti...

The automatic postinstall overwrite of multiple third-party AI-agent skill locations is concrete install-hook abuse. The lack of installer network activity does not remove the control-sur...

The automatic lifecycle hook writes package-controlled instructions into multiple foreign AI-agent skill directories. This meets the install-time AI-agent control-surface mutation block p...

Source inspection confirms credential collection and transmission of the raw GitHub token to a hard-coded non-GitHub endpoint. This is concrete credential-exfiltration behavior, despite b...

This is unconsented postinstall mutation of foreign AI-agent configuration and instruction surfaces. It meets the install-hook abuse blocking policy even without demonstrated credential t...

The automatic postinstall rewrite of a separate AI-agent extension is a concrete foreign control-surface mutation. Its narrow visible purpose reduces certainty about broader intent but do...

This is an automatic install-time remote code delivery chain with disabled TLS validation and no integrity verification. The downloaded native payload is opaque to the package review and...

This is concrete, obfuscated payment-flow hijacking and external data transfer, even though it is not automatically run by npm installation. The missing declared entrypoint further sugges...