npm security reports, with evidence.

The package contains a complete, automatically invoked path that fingerprints coding-agent and sandbox environments and transmits the resulting identifiers. Although it has no install hoo...

The automatic hook mutates and activates integrations across unrelated AI-agent configurations, which is concrete install-hook abuse. This meets the blocking policy even without evidence...

This is an automatic install-time remote-code execution chain that can mutate the installing machine through unpinned external content. The global-install gate limits reach but does not r...

The package contains a concrete default credential-forwarding path to an external Research MCP endpoint. The absence of an npm lifecycle hook does not mitigate this runtime credential exf...

Source directly connects account configuration containing an optional password to an external logging endpoint. The lifecycle hook is not the exfiltration mechanism, but it does execute a...

The package sends serialized IMAP account data to an unrelated external logging endpoint during normal runtime, and that data structure includes a password. This is concrete credential ex...

This is a concrete, automatic, remotely controlled modification of a user's WhatsApp account state that is unrelated to establishing a connection. The install hook is benign, but it does...

The automatic lifecycle hook modifies a consumer-owned MCP configuration rather than only package-owned files. That creates an unconsented agent-extension execution path.

This is concrete install-time remote-access and persistence behavior affecting local and remote SSH control surfaces. Existing credentials gate success but do not provide meaningful conse...

The package has a concrete automatic postinstall chain that overwrites skill content in Claude, agent, and Codex directories. Opt-out support does not establish consent for the default mu...

This is an unconsented postinstall mutation of broad AI-agent control surfaces in the consumer project. The automatic configuration includes remote MCP endpoints and a command launcher.

The package performs unconsented postinstall mutation of foreign AI-agent instruction files. This meets the install-control-surface blocking policy even though no exfiltration was found.

The package performs unconsented postinstall mutation of broad consumer AI-agent control files. This meets the install-control-surface blocking policy despite no observed exfiltration.

The package embeds automatic, hardcoded third-party telemetry in a UI component and exports embedding-site metadata when the component is used. This is concrete runtime data exfiltration...

The package embeds concealed remote license enforcement that can destroy a consumer application's visible DOM at runtime. This is concrete destructive behavior, despite the absence of ins...

The automatic self-update and unattended reconfiguration create a persistent agent-control path, and the injected instruction explicitly suppresses permission requests for external action...

This is a concealed, remotely controlled kill switch in a browser component, protected by deliberate obfuscation. It has no install-time hook or secret harvesting, but the concrete remote...

This is an unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The lifecycle hook directly persists package-authored instructions into Claude Code and Codex loca...

This is a concrete destructive install-hook abuse: the package automatically rewrites broad consumer-project files and persists control through an injected build plugin. The reviewer-dire...

This is an automatic postinstall mutation of foreign AI-agent control surfaces combined with execution of another CLI installer. Under the isolation policy, that concrete chain requires b...

This is unconsented install-time system and host information exfiltration. The automatic lifecycle hook makes the behavior a concrete malicious install-hook abuse.