npm security reports, with evidence.

The source directly combines secret-bearing account logging with an automatic remote request to an unrelated host. The limited workspace-link postinstall hook does not mitigate this runti...

The package uses an automatic lifecycle hook to execute remote code and install an AI-agent plugin outside the package itself. The global-only guard does not establish user consent for th...

The package automatically changes a consumer project's lifecycle configuration and installs AI-agent plugins during dependency installation. These are concrete, broad control-surface muta...

The browser payload intentionally blocks a host page's controls behind an encoded overlay, which is concrete malicious behavior. Lack of a normal manifest entry limits automatic activatio...

This is malicious because an automatic lifecycle hook alters global Claude Code telemetry settings to export sensitive AI-session content. The opt-out does not establish prior consent.

The automatic postinstall changes both consumer-project and home-directory AI-agent configuration, including enabled MCP commands and a pre-tool hook. This meets the install-hook abuse bo...

The source directly sends serialized IMAP configuration, including a possible password field, to an external logging endpoint during normal runtime initialization. This is concrete creden...

The automatic postinstall mutation of broad, foreign AI-agent control surfaces is a concrete malicious install-hook abuse under the policy. The absence of visible credential theft does no...

This package uses an automatic npm lifecycle hook to modify a global AI-agent configuration rather than requiring an explicit user setup action. The registered server can then execute rep...

This package has a concrete, unconsented postinstall chain that mutates broad third-party AI-agent control surfaces and a user dependency environment. The behavior meets the install-hook...

The automatic postinstall mutation of a foreign Codex SDK is a concrete install-time AI-agent control-surface change. Static inspection found no secret theft or network activity in that l...

The automatic global lifecycle hook broadly mutates AI command resolution and establishes scheduled self-updating persistence. This satisfies the install-hook abuse policy even though no...

The package automatically injects persistent Claude Code hooks during installation, rather than limiting that agent integration to an explicit user command. This meets the install-time fo...

This is an unconsented postinstall mutation of the consumer project's Claude skill configuration. The absence of network or secret theft does not neutralize the automatic agent-control ta...

The source implements a default credential-forwarding path to a third-party endpoint during normal tool use. The explicit option does not remove the default external disclosure.

This is concrete destructive runtime behavior unrelated to a flying-reaction UI, concealed by obfuscation and controlled by a remote endpoint. The absence of an install hook does not miti...

The package silently sends mail-account metadata to an unrelated endpoint during ordinary runtime. No install hook is involved, but the confirmed default data disclosure is concrete malic...

The package performs an automatic postinstall rewrite of a foreign Codex SDK solely to hide its spawned console. This meets the install-hook abuse boundary for unconsented mutation of an...

The package performs automatic, persistent consumer-project and Claude control-surface changes from postinstall. This exceeds a first-party extension setup because it injects a recurring...

The package uses automatic install hooks to make broad operating-system changes and download a browser payload. That is concrete install-hook abuse even though secret theft was not confir...

The malicious production dependency is sufficient for a supply-chain compromise even without a lifecycle script. Manifest and README inconsistencies reinforce that this is not a coherent...