npm security reports, with evidence.

This is an unconsented install-time remote-code-execution chain that can broadly alter the host outside the reviewed package contents. The guards reduce accidental execution but do not ma...

This is a concrete postinstall mutation of a foreign project's AGENTS.md and agent instruction files. The guarded and non-destructive implementation does not remove the unconsented contro...

The automatic postinstall patch chain rewrites an external AI-agent package and establishes a per-user hook on future launches. This meets the install-hook abuse policy even though no sec...

Source establishes automatic external transmission of local identity and project metadata during normal tool use. No install hook is present, but the confirmed data exfiltration is suffic...

The package has a concrete automatic lifecycle path that overwrites and prunes a consumer-wide AI-agent control directory. Local-only execution does not remove the control-hijack risk.

This package performs unconsented, destructive postinstall mutation of a consumer project and persists control through an injected build plugin. That behavior is not necessary for a libra...

The automatic lifecycle hook modifies a foreign global CodexHost launcher and renderer, then arranges later execution of package-controlled code. Explicit setup download behavior does not...

Direct source inspection confirms a normal-runtime, default-configured outbound logging path to active external webhooks. The absence of install hooks does not mitigate this concrete appl...

The package automatically executes unpinned remote shell code and alters a separate home-directory AI-related tool during postinstall. This is a concrete unconsented install-hook abuse pa...

The package performs unconsented postinstall environment collection, internal metadata probing, persistence, and third-party reporting. Its self-description does not neutralize these conc...

The package contains an automatic install-time data-collection and external-egress path, not merely an inert test fixture. Its self-described testing purpose does not provide consumer con...

This is unconsented install-time command execution and host-data exfiltration to a third-party endpoint. The import-time trigger reinforces the malicious lifecycle behavior.

An automatic preinstall hook launches a deliberately obscured payload with concrete credential and outbound automation capabilities. This is malicious install-hook abuse.

This is a concrete malicious install-time chain: an automatic lifecycle hook executes an opaque payload with credential, network, filesystem, and process capabilities unrelated to the sta...

The automatic preinstall hook executes a deliberately concealed, capability-rich payload. This is concrete install-hook abuse, not package-aligned setup.

The automatic preinstall execution of concealed credential- and network-capable code is concrete malicious install-hook behavior. Readable CLI functionality and the package-aligned spec c...

The package contains an automatic postinstall path that mutates a foreign, user-wide AI-agent configuration and installs agent skills. This is concrete unconsented install-hook abuse unde...

The source establishes an automatic postinstall chain that broadly modifies user AI-agent configuration and installs a separate executable MCP dependency. This meets the firewall policy f...

The automatic lifecycle hook makes destructive and account-provisioning changes to a user-level AI-agent control surface. This is unconsented install-hook abuse, despite the vendor-aligne...

The automatic postinstall hook mutates numerous third-party AI-agent skill locations, including an unconditional universal fallback. This meets the blocking policy for unconsented broad A...

This is an unconsented postinstall mutation of a consumer AI-agent control surface. The automatic MCP registration and persistent agent-instruction writes meet the blocking policy.