npm security reports, with evidence.

The automatic postinstall performs unconsented, broad mutation of consumer AI-agent configuration and installs executable control hooks. This meets the blocking policy even though the ins...

This is concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces. The installed capability also drives automated access-evasion behavior, so it meets the inst...

The package uses an automatic postinstall to mutate consumer project agent configuration and persist its own future execution in the consumer package.json. This meets the install-hook abu...

The package combines automatic lifecycle execution with unvalidated remote AI command execution in the user's shell. This is a concrete remote-code-execution attack surface, not merely or...

The package has a concrete automatic postinstall chain that broadly changes consumer-project Claude configuration and installs agent plugins. This meets the install-hook abuse blocking bo...

This is an automatic install-time takeover of a global AI-agent command outside the package directory. The global-install guard and absence of visible JavaScript exfiltration do not remov...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and a user Python environment. That is concrete install-hook abuse under the stated policy.

Source inspection confirms a user-triggered credential-redirection and persistence path to a fixed gateway. The absence of install hooks lowers propagation risk but does not remove the cr...

This is an automatic postinstall write to a foreign, behavior-bearing AI-agent control surface, with recursive overwrite semantics. That concrete install-time mutation meets the blocking...

The package performs unconsented postinstall mutation of both Codex and Claude user skill directories, plus user-level dependency installation. This is concrete install-hook abuse under t...

The automatic postinstall hook modifies global Cursor agent configuration and skills, rather than requiring an explicit user setup action. This meets the install-hook abuse boundary for a...

The package has a concrete automatic install-time chain that modifies both Codex and Claude user skill stores and deletes stale destination content. This meets the install-control-surface...

The source establishes automatic remote export of sensitive email-account metadata and broad diagnostic output during ordinary client use. The bounded workspace-link postinstall hook does...

The package has a concrete automatic postinstall chain that mutates consumer and user-home AI-agent configuration and enables package plugins. This meets the policy threshold for unconsen...

The default routing of an OpenAI credential to a different fixed gateway is concrete credential exfiltration during normal use. The unchecked executable fallback adds supply-chain executi...

OpenSSF/OSV malware advisory MAL-2026-15866 blocks this version. package.json at line 14 declares a runtime dependency `microfrontend` whose source is a bare HTTPS URL (`https://repo.arti...

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The configuration persists across projects and installs commands triggered by future Claude Code sess...

This is an unconsented postinstall mutation of a broad AI-agent control surface. The automatic hooks and global instruction changes meet the install-hook abuse blocking policy.

Automatic global-install mutation of OpenCode's configuration adds a package plugin and broad shell permission. This meets the policy threshold for malicious install-hook abuse even witho...

The guarded global-install condition does not establish user consent for automatic OpenCode configuration and permission changes. The lifecycle hook creates a persistent, broadly permitte...

This is an automatic install-time mutation of foreign AI-agent control surfaces, including persistent instructions and command hooks. The global-only guard does not provide consent for th...