npm security reports, with evidence.

The automatic postinstall hook broadly mutates foreign AI-agent skill and plugin control surfaces, including enabling and installing a Codex plugin. This is concrete unconsented install-h...

The package automatically harvests raw agent session logs and routes them into cloud sync, while its telemetry bypasses personal opt-out for company-attributed activity. The guarded globa...

The package contains concrete import-time protestware in both published JavaScript entry bundles. The lack of install hooks does not mitigate the targeted runtime denial of page interaction.

The automatic lifecycle changes consumer package-manager behavior and writes AI-agent instructions, skills, and review exclusions into the project. These actions are concrete control-surf...

The package uses an automatic npm lifecycle hook to modify the host OS and request privileged package installation. This is concrete install-hook abuse, not a user-invoked setup action.

This is concrete unconsented install-time host data exfiltration to an external endpoint. The lifecycle trigger and callback are directly established by source inspection.

The automatic postinstall hook mutates a broad AI-agent control surface by signaling matching external PM2 processes. Its global-install guard and opt-out do not establish consent for eac...

This is an automatic install-time remote native payload chain with disabled TLS verification and no integrity check. It creates a concrete supply-chain execution risk despite no observed...

This is an unconsented install-time mutation of foreign AI-agent control surfaces, compounded by automatic user-level pip installation. The behavior meets the install-hook abuse blocking...

This is a concrete credential-harvesting payload automatically deployed into an auto-loaded agent skill path. The benign native-module rebuild postinstall hook does not neutralize the run...

The automatic lifecycle hook performs broad, destructive agent-configuration changes and activates a plugin across existing tools. This meets the install-hook abuse block policy despite n...

The package contains a concrete runtime path that defaults to third-party webhooks and posts rich application records. Although it has no install hook, the embedded destination and automa...

This package performs unconsented, automatic host-level package installation and destructive dependency mutation during postinstall. The behavior is concrete install-hook abuse even thoug...

The package contains a concrete default library path that transmits an API credential to an external remote execution service. The absence of install hooks and the safer CLI default do no...

Both published entry bundles contain a guarded but concrete third-party account-profile collection and upload path. The absence of an install hook does not neutralize this runtime data-ex...

The package embeds active third-party webhook endpoints as the default destination for rich runtime logs and transmits the serialized records automatically. This is concrete unconsented d...

The postinstall hook automatically overwrites global Pi agent instructions and creates user-wide files. This meets the install-hook abuse policy even though no network exfiltration was fo...

Source inspection confirms an automatic postinstall that writes a wildcard Claude Code hook into the consuming project. This meets the policy threshold for malicious install-hook abuse re...

The source implements a deliberate, reachable macOS sandbox escape through launchd. Its local postinstall notification does not remove the concrete runtime bypass.

The global postinstall path automatically modifies multiple AI-agent instruction surfaces and enables Codex network access. The remote-authority instruction makes the resulting control pa...

This is a remotely controlled, broad destructive operation disguised as cache cleanup. Its explicit invocation requirement reduces automatic exposure but does not make the behavior safe o...