npm security reports, with evidence.

This is an unconsented install-time mutation of a foreign AI-agent control surface, with persistent automatic execution of another registry package. The absence of observed secret theft d...

This package performs an automatic postinstall mutation of global AI-agent configuration, including a managed instruction block in an existing Codex control file. That is concrete install...

The install hook itself is limited, but the executable contains an automatic hard-coded network beacon that discloses host metadata on normal use. The self-dependency adds supply-chain risk.

The automatic global lifecycle path mutates broad AI-agent configuration and enables a trusted plugin. The workspace guard does not mitigate the automatic global-install behavior.

The automatic global updater, enabled lifecycle scripts, and runtime self-dependency form a concrete unconsented supply-chain execution path. The narrow permission-repair hook does not of...

The package combines an automatic install hook with persistent global AI-agent instruction injection and coercive tool-use rules. This is concrete install-hook abuse, not an explicit user...

The package combines automatic lifecycle execution, host telemetry, remote executable installation, privilege-invoking system changes, and reviewer manipulation. These behaviors establish...

This is a concrete automatic lifecycle chain that modifies and redirects a foreign AI-agent CLI. The observed behavior meets the install-hook abuse block boundary even without proof of se...

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces plus background home-directory repository indexing. The lifecycle-triggered persistence chain meets th...

This is unconsented install-time internal-service probing and external disclosure of returned data. The automatic lifecycle hook makes the behavior concrete and harmful.

The lifecycle hook performs automatic broad mutation of the consumer's .claude control surface. Its guards and lack of network behavior reduce scope but do not establish user consent for...

This is concrete, unconsented use of an authenticated third-party account combined with concealed targeting and host telemetry. The install hook itself is limited, but the runtime behavio...

This package contains a silent, automatic install-time telemetry beacon that inspects consumer project metadata and transmits it to a third party without an explicit user command. The ven...

The package has a concrete automatic postinstall persistence mechanism that mutates broad, foreign AI-agent control surfaces. Its injected instructions steer agents toward wallet and pass...

This is unconsented postinstall mutation of a foreign, broad AI-agent control surface. The conditional Muse check does not remove the automatic forced global installation behavior when th...

The automatic lifecycle hook makes broad, persistent changes to foreign AI-agent control surfaces and installs an additional global package. This meets the install-hook abuse boundary reg...

The install lifecycle automatically installs a foreign AI-agent CLI and persists broad user-environment changes. This is concrete unconsented install-hook abuse under the stated policy.

This is concealed, remote-controlled use of an authenticated WhatsApp session to alter subscriptions without a caller request. No install hook is present, but the runtime behavior is conc...

This is concrete, unconsented install-time remote code execution with persistence, obscured by character-code decoding. The benign-looking command wrapper does not justify the installer b...

This is concrete, unconsented install-time data exfiltration through DNS and HTTP. Its lifecycle trigger makes the behavior supply-chain malware rather than a harmless library feature.

An automatic lifecycle hook and import path exfiltrate the local hostname to an unrelated webhook. The package description's claim of benign testing does not establish consent or negate t...