npm security reports, with evidence.

The inspected source establishes an automatic postinstall chain that writes and merges global AI-agent configuration. This is concrete install-hook abuse under the stated policy.

The package has no install hook, but its normal runtime creates a remote command channel that can select arbitrary local directories and return file contents to the endpoint. That is conc...

This is concrete default-on collection and third-party transmission of local environment metadata during normal CLI use. The absence of an install hook limits the trigger but does not rem...

Runtime source establishes deliberate AI-directed source-inspection suppression plus remote collection of host-derived identifiers and error text. These behaviors create a concrete agent...

The package has no automatic npm lifecycle hook, but its explicit setup command exports authentication JSON to a remote cache and can install remotely selected code. The concrete credenti...

The package combines an automatic global postinstall hook with broad PATH and command interception for Claude Code and Codex, recurring scheduled execution, and automatic remote package u...

This is automatic, unrelated install-time telemetry sent to a fixed external receiver. The behavior is a concrete data-exfiltration attack surface.

The launcher implements undisclosed collection and exfiltration of CLI and environment-derived data, including error stacks, to fixed logging endpoints. Although there is no install hook,...

The install lifecycle performs broad project-level Claude control-surface mutation rather than limiting itself to package-owned files or an explicit setup command. No lifecycle exfiltrati...

This is concrete unconsented install-time data exfiltration combined with remote opaque executable staging. Hash validation limits transit tampering but does not make the automatic collec...

The source establishes a complete path from a local secret file to a package-controlled network endpoint, triggered by remote control activity. The harmless postinstall message does not m...

The automatic lifecycle hook downloads and executes opaque native code specifically to install AI-agent hooks. This meets the install-control-surface blocking policy.

The package has a concrete automatic postinstall path that mutates global AI-agent configuration and activates companion extensions. This meets the install-hook abuse boundary even though...

Direct source inspection confirms an automatic postinstall chain that delegates permission changes and Chrome MCP registration to a third-party bridge. This is an unconsented install-time...

The postinstall hook makes unconsented, broad changes to foreign AI-agent control surfaces and the host. This meets the install-hook abuse blocking policy despite its global-install guard...

The package combines reviewer and assistant-directed social engineering with an explicit command that persistently changes consumer lifecycle scripts and transmits dependency inventory. I...

Direct inspection confirms an automatic install hook establishing hidden, elevated at-logon persistence and a daemon restart loop. No external exfiltration was found in the reviewed persi...

This is an unconsented install-time mutation of broad consumer AI-agent control surfaces, reinforced by lifecycle-setting changes and reviewer-suppression payloads. The absence of observe...

The import-time payload combines deliberate obfuscation, host access, concealed process creation, and network transmission. Its behavior is incompatible with the advertised package surface.

The package contains a concrete credential-disclosure path that is selected by default through its exported API. The lack of an install hook and safer CLI default do not remove this libra...

The package directly exfiltrates a wallet private key during ordinary SDK operations. This is credential theft, regardless of the stated gas-sponsorship purpose.