npm security reports, with evidence.

tabwright@4.0.0 uses postinstall to persist package-controlled instructions in ~/.agents/skills. This is an unconsented mutation of a broad AI-agent control surface and meets the publish-...

The hardcoded, active remote logging path is concrete runtime data exfiltration, even though it is not install-time behavior. The absence of lifecycle hooks does not remove the runtime di...

The automatic global AI-agent configuration mutation establishes a concrete install-time control-hijack path. Platform gating and tarball integrity checking do not remove that unconsented...

The credential transfer to guest sessions and guest-controlled shell execution are concrete harmful behaviors, despite requiring daemon runtime rather than npm installation.

Hardcoded third-party webhooks are enabled by default and receive rich runtime records through ordinary module operations. The absence of an install hook limits the trigger to runtime but...

The package has a concrete automatic postinstall path that creates enabled MCP configuration and deploys remotely supplied content into a consumer project. Existing-file preservation and...

The automatic postinstall modifies the consumer project's OpenCode configuration and installs enabled npx-based MCP commands. This meets the install-time AI-agent control-surface abuse bo...

This is a concrete import-time remote code execution mechanism, not ordinary validation functionality. No install hook is needed because the main entry point starts the daemon automatically.

The package has a concrete automatic postinstall path that mutates several unrelated user-level AI-agent control surfaces. No self-dependency or exfiltration was needed to establish insta...

The automatic postinstall performs unconsented global Claude Code installation and persistent user-level configuration changes. This is a concrete install-hook abuse chain affecting a for...

This is concrete AI-agent control hijacking and provider impersonation, not ordinary gateway behavior. The absence of an install lifecycle hook does not remove the runtime attack path.

The package contains a concrete postinstall path that alters several third-party AI-agent skill directories and installs instructions that influence later agent actions. This meets the po...

This is a complete unconsented postinstall chain that mutates a consumer AI import path and transmits intercepted LLM content remotely. The behavior meets the install-hook abuse policy fo...

This is a concrete install-hook abuse chain: automatic lifecycle execution obtains and runs remote code, globally installs software, and persists fetched content. The isolated shared-agen...

The install hook automatically and silently modifies both Claude and Codex global configuration, registering executable package code. This meets the blocking policy for unconsented lifecy...

The automatic lifecycle hook mutates foreign, broad AI-agent configuration files and installs a package-controlled MCP server without consent. This meets the install-control-surface block...

The package covertly transmits sensitive user input and authentication-related exam state, and obscures related runtime code. Its prepare-only hook does not reduce the confirmed runtime d...

The package establishes a detached, import-time remote code execution path controlled by its signing-server operator. Its scanner-directed claim that signatures eliminate malware risk fur...

This package implements unprompted import-time remote code execution and persistence through a detached process. Signature verification does not remove the remote operator's ability to de...

The automatic postinstall chain modifies another package's launcher and renderer, then makes the modification self-healing and persistent across normal launches. This meets the install-ho...

The package performs unconsented postinstall mutation of global Pi-agent settings and global Maestro workflow locations. No exfiltration was found in the inspected installer scripts, but...