npm security reports, with evidence.

The package implements credential-pool routing and a remotely controlled destructive account wipe, alongside automatic shell persistence. Although there is no npm install hook, these conc...

This is unconsented postinstall mutation of a foreign AI-agent control surface, including third-party plugin installation. The automatic detached reconciliation makes the mutation persist...

The automatic postinstall performs broad destructive mutation of ~/.claude and registers browser-agent integration. This is an unconsented install-time mutation of a foreign AI-agent cont...

This package contains concrete, unconsented mutations of a user's WhatsApp subscriptions and message content, plus a reachable shell-injection flaw. These behaviors are unrelated to ordin...

The confirmed install-time mutation of consumer files and existing AI-agent configuration is a concrete unconsented control-surface change. No exfiltration was needed to establish the ins...

This is concrete unconsented postinstall mutation of broad OpenCode and consumer-project control surfaces, reinforced by runtime self-update behavior. The package-aligned endpoints and pa...

The executable forwards both GitHub Actions identity and environment-derived secrets to a fixed remote service. The absence of an install hook reduces reachability but does not remove the...

This is unconsented install-time mutation of a consumer project and its future lifecycle behavior, with detached reconciliation to continue the chain. The CI guard and reduced mode do not...

This is deliberate, concealed, user-unconsented account manipulation on the normal runtime path. The harmless version-check install hook does not mitigate the runtime behavior.

The package has a concrete automatic postinstall path that broadly modifies consumer OpenCode assets and configuration, including registration of another plugin. No exfiltration was found...

Automatic system-package installation and browser/system-dependency installation are materially broader than ordinary package setup and execute before the user runs the package. The lifec...

The startup-enabled plugin creates a default remote command channel that can replace AI-agent skills from arbitrary URLs without package-side authorization or archive integrity verificati...

The package has a concrete automatic postinstall chain that modifies consumer package-manager policy and broad AI-agent control surfaces, then suppresses review of the resulting files. Th...

The package has a concrete, automatic postinstall chain that writes and deletes files in default Codex and Claude skill directories, plus performs dependency installation. This meets the...

Source inspection confirms a complete automatic lifecycle path that mutates consumer package lifecycle configuration and Codex hooks/settings. This meets the install-time foreign AI-agent...

This is an unconsented postinstall mutation of multiple foreign AI-agent configuration surfaces. The injected latest-version npx command adds a continuing remote execution path.

The package performs unconsented postinstall mutation of consumer and user AI-agent control surfaces, then persists execution through the consumer lifecycle and Git configuration. This me...

The hard-coded external receiver is enabled by default for the ScanOrder logger, and the provider serializes and transmits runtime records to it. This is concrete data exfiltration behavi...

The lifecycle hook makes broad AI-agent configuration changes and user-level dependency installation automatically. This meets the install-hook abuse blocking policy even though no direct...

The package performs automatic postinstall deployment of executable AI-agent hooks and configuration into a consuming project, then hides its installation footprint. This meets the instal...

The package combines an automatic lifecycle hook, a self-dependency selecting another release, broad consumer-project mutation, user-wide AI-agent changes, and detached persistence of the...