npm security reports, with evidence.

The automatic postinstall chain writes behavior-bearing configuration into Claude and Codex homes and registers command hooks. This meets the install-hook abuse policy even though no auto...

The implementation's unrestricted recursive deletion contradicts its cache-cleanup description. The remote authorization gate adds covert control over a destructive payload.

The package explicitly reads locally available GitHub credentials and sends them to a hard-coded external endpoint. The lack of an install hook limits the trigger but does not remove the...

The postinstall hook automatically mutates a browser agent-control surface by registering native hosts and launchers. This meets the install-time control-surface blocking policy despite t...

The package has no install lifecycle hook, but its normal CLI runtime collects GitHub credentials and forwards them to an external default endpoint. That concrete credential-exfiltration...

The package forwards usable GitHub credentials to a remote service under its control and couples this with automatic telemetry and self-updating behavior. Although it lacks install hooks,...

Automatic installation overwrites a foreign global AI-agent instruction file and installs user-wide command files. That concrete lifecycle behavior meets the install-hook abuse policy des...

The source directly forwards locally available GitHub credentials to a non-GitHub default endpoint. The lack of lifecycle hooks reduces propagation risk but does not remove the credential...

The automatic lifecycle hook modifies a global Cursor instruction directory and activates installed instructions globally. This satisfies the install-hook policy for a broad AI-agent cont...

The code establishes automatic exfiltration of credential-bearing chat metadata and transcript contents to a remote endpoint, plus runtime mutation of Git credential handling. The absence...

The package has a concrete automatic lifecycle path that overwrites a foreign, broad AI-agent control surface. Although no exfiltration was found, this satisfies the install-time agent-co...

The concrete postinstall write to the consumer's CLAUDE.md meets the policy for unconsented mutation of a foreign AI-agent control surface. The absence of observed network or credential b...

This is an unconsented postinstall mutation of a foreign AI-agent control surface. The lifecycle hook overwrites consumer skill directories, meeting the blocking policy even without obser...

The package contains a postinstall hook that mutates multiple AI-agent host configurations during global installation. This meets the policy definition of unconsented lifecycle mutation o...

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, not merely an explicit setup command. The downstream npx MCP command further expands the supply-chain...

The automatic postinstall broadly mutates foreign AI-agent control surfaces and invokes an automatic upgrade path. This is concrete install-hook abuse, not a user-invoked or package-owned...

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

OpenSSF/OSV malware advisory MAL-2026-4533 blocks this version. The npm package `codebuff-cli` impersonates the legitimate `codebuff` package (README copied verbatim from the official Cod...

OpenSSF/OSV malware advisory MAL-2026-13933 blocks this version. The npm package `cc-skills-helper` is a Windows-only supply-chain dropper published as seven versions (1.0.0 through 1.0.6...

OpenSSF/OSV malware advisory MAL-2026-13933 blocks this version. The npm package `cc-skills-helper` is a Windows-only supply-chain dropper published as seven versions (1.0.0 through 1.0.6...