npm security reports, with evidence.

Source establishes automatic, unconsented mutation of Gemini's global instruction control surface, beyond package-owned extension setup. This meets the specified blocking policy without r...

The inspected lifecycle chain performs unconsented mutation of broad AI-agent control surfaces, meeting the supplied blocking policy. Existing-file safeguards do not provide consent for a...

The source proves unconsented postinstall mutation of a broad, foreign AI-agent control surface, enabling detailed telemetry across unrelated sessions. This meets the blocking policy inde...

Inspected source establishes unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. This conclusion rests on executable lifecycle behav...

Source proves unconsented postinstall mutation of a foreign, global AI-agent control surface, meeting the explicit blocking policy. The verdict rests on the automatic configuration write,...

The inspected source establishes automatic data exfiltration during installation. The security research label does not neutralize the active collection and transmission behavior.

The inspected source establishes unconsented postinstall mutation of a foreign, user-level AI-agent control surface, which meets the supplied blocking policy. The interactive prompt and m...

The inspected installation hook performs unconsented mutation of global agent instructions, meeting the specified blocking rule. Package-owned instruction storage and an opt-out do not ne...

OpenSSF Malicious Packages via OSV confirms @bottino/baileys@1.0.0 as malicious (MAL-2026-17351): Malicious code in @bottino/baileys (npm)

The source establishes unconsented postinstall mutation of a broad AI-agent control surface, enabling detailed global session telemetry. This meets the blocking policy independently of ci...

Source establishes unconsented postinstall mutation of a foreign global AI-agent control surface, meeting the supplied blocking policy. This decision does not depend on citation capacity...

Inspected source establishes automatic, unconsented writes to GitHub Copilot’s user agent and skill directories. This meets the supplied blocking policy for foreign AI-agent control-surfa...

Source establishes unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. Interactive prompts and conflict preservation do not guard the...

Source proves unconsented postinstall mutation of a broad AI-agent control surface, including default content telemetry. This meets the blocking policy independently of citation coverage...

Source proves an unconsented npm postinstall mutation of a broad AI-agent control surface, which meets the blocking policy. Backups and an opt-out do not prevent the default global teleme...

Source proves unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the supplied blocking rule. Preserving existing Claude settings limits exposure but doe...

The source establishes automatic, unconsented disclosure of local environment information to an external recipient. Research labels do not neutralize the active exfiltration behavior.

Source proves unconsented postinstall mutation of user-wide AI-agent settings, which meets the blocking policy. The default telemetry configuration adds concrete session-content exposure...

The inspected postinstall performs unconsented mutation of foreign AI-agent preset configurations, meeting the supplied blocking rule. Its functional purpose and matching guards do not re...

The automatic lifecycle path combines foreign agent configuration writes with deliberate bypass of an existing agent safety hook. That bypass satisfies the blocking exception despite the...

The inspected chain establishes automatic postinstall mutation of foreign AI-assistant control surfaces, meeting the blocking policy. Package-related skill content and skip guards do not...