npm security reports, with evidence.

OpenSSF Malicious Packages via OSV confirms homestack-cheer@1.1.1 as malicious (MAL-2026-16333): Malicious code in homestack-cheer (npm)

OpenSSF Malicious Packages via OSV confirms homestack-cheer@1.1.0 as malicious (MAL-2026-16333): Malicious code in homestack-cheer (npm)

OpenSSF Malicious Packages via OSV confirms homestack-cheer@1.0.2 as malicious (MAL-2026-16333): Malicious code in homestack-cheer (npm)

OpenSSF Malicious Packages via OSV confirms homestack-cheer@1.0.1 as malicious (MAL-2026-16333): Malicious code in homestack-cheer (npm)

OpenSSF Malicious Packages via OSV confirms homestack-cheer@1.0.0 as malicious (MAL-2026-16333): Malicious code in homestack-cheer (npm)

Direct source inspection establishes unconsented postinstall mutation of broad third-party AI-agent control surfaces, meeting the blocking policy. Source citation tools failed with a clos...

Inspected source establishes unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Citation issuance repeatedly failed because the tool trans...

Inspected source establishes unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Citation issuance repeatedly failed because the tool trans...

Inspected source proves unconsented postinstall mutation of foreign and broad AI-agent control surfaces, which meets the blocking policy. The verdict rests on the executable installation...

Source confirms automatic postinstall mutation of OpenClaw's skill directory without consent. This meets the blocking policy for foreign AI-agent control-surface writes, despite otherwise...

The source establishes automatic, unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. The limited skill scope and absence of exfiltrat...

The inspected lifecycle chain performs unconsented changes to foreign AI-agent control surfaces and explicitly disables a safety preload. These concrete behaviors exceed guarded package-o...

Source establishes automatic, unconsented install-time mutation of foreign AI-agent control surfaces, accompanied by targeted safety-preload removal. This meets the blocking policy despit...

Source establishes automatic postinstall mutation of foreign AI-agent control surfaces, which meets the blocking policy. Package-related skill content and installation guards do not neutr...

Source establishes automatic, unconsented mutation of Gemini's global instruction control surface, beyond package-owned extension setup. This meets the specified blocking policy without r...

The inspected lifecycle chain performs unconsented mutation of broad AI-agent control surfaces, meeting the supplied blocking policy. Existing-file safeguards do not provide consent for a...

The source proves unconsented postinstall mutation of a broad, foreign AI-agent control surface, enabling detailed telemetry across unrelated sessions. This meets the blocking policy inde...

Inspected source establishes unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. This conclusion rests on executable lifecycle behav...

Source proves unconsented postinstall mutation of a foreign, global AI-agent control surface, meeting the explicit blocking policy. The verdict rests on the automatic configuration write,...

The inspected source establishes automatic data exfiltration during installation. The security research label does not neutralize the active collection and transmission behavior.