npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13933 blocks this version. The npm package `cc-skills-helper` is a Windows-only supply-chain dropper published as seven versions (1.0.0 through 1.0.6...

The package has a concrete automatic install hook that modifies a foreign AI-agent SDK. Its narrow Windows scope reduces impact but does not establish user consent for the mutation.

The automatic postinstall writes package-controlled content into the global Claude skills control surface, meeting the install-hook abuse boundary. The remote-login cookie transfer adds a...

The package combines automatic installation and self-updating with broad credential collection and remote upload. The cloud command is user-invoked, but its default snapshot behavior expo...

The combination of concealed AI-agent fingerprinting and automatic global installation of a runtime-selected self release is a concrete staged supply-chain capability. No install hook is...

The package performs automatic postinstall writes into multiple third-party AI-agent skill locations. This meets the install-control-surface blocking rule even though the media downloader...

The postinstall lifecycle performs unconsented mutation of foreign and broad AI-agent control surfaces. This meets the install-hook abuse blocking boundary despite skipping paths where no...

The package uses an automatic npm postinstall hook to mutate foreign AI-agent configurations and install additional agent software without an explicit user setup command. This is concrete...

The package contains concrete remote-code-execution and automatic transcript-upload behavior. Although neither occurs at npm install time, the lack of installer verification and automatic...

Automatic installation mutates a foreign, user-wide AI-agent control surface and installs unrestricted command hooks. This is concrete install-hook abuse regardless of the Telora binary n...

This is an unconsented post-install takeover of a foreign AI command's per-user executable and configuration surface, reinforced by package-name and README inconsistency. The absence of d...

The source implements concrete runtime credential disclosure to two hard-coded external receivers, not merely ordinary analytics. No install-time behavior is needed for the credential-exf...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces, with an additional user-environment package installation. The behavior meets the install-control-s...

The automatic lifecycle chain mutates Claude Code and VS Code AI configuration and enables telemetry hooks without a user setup command. This meets the install-control-surface blocking rule.

This is a concealed browser redirector packaged as an npm module, with encrypted remote destination resolution and a challenge-gated redirect. The lack of lifecycle hooks does not neutral...

The package contains a concrete runtime credential-exfiltration path to a hard-coded third-party host. The absence of an install hook does not mitigate this behavior when the Android boot...

The package contains a concrete credential-exfiltration path, despite having no npm lifecycle hook. The logging endpoint is unrelated to the mail providers and receives serialized account...

The source establishes automatic transmission of broadly captured application logs to a package-controlled endpoint, including sensitive mail-account metadata. The lifecycle hook is not i...

The package implements automatic, silent exfiltration of application logs to an unrelated endpoint, and those logs demonstrably include mail and account data. The workspace-only postinsta...

The package contains a concrete, automatic data-exfiltration path to a package-controlled host. Its narrow postinstall hook does not remove the runtime privacy and credential-context risk.