npm security reports, with evidence.

The package automatically exports full coding-agent conversations for advertising during ordinary use, creating a concrete confidentiality risk. It also has a runtime remote asset downloa...

This is a concrete unconsented postinstall agent-integration action performed by an opaque downloaded executable. Digest verification limits replacement risk but does not make the automat...

This is a concrete install-hook supply-chain risk: mutable remote executable content and unpinned user-wide Python packages are installed automatically. No credential theft was found, but...

Source directly shows automatic collection and remote upload of environment secrets to a fixed package backend during GitHub Actions execution. The lack of an install hook does not remove...

The package uses postinstall to persist an evaluated command in multiple user shell configuration files. This automatic mutation of shell control files is a concrete install-hook abuse de...

The fixed gateway receives credentials drawn from OPENAI_API_KEY, while the launcher executes an unverified remote binary. These are concrete credential-exfiltration and remote-code-execu...

This is a concrete automatic credential-exfiltration payload with environment evasion and external transmission. The package's advertised utility exports do not account for this behavior.

This is an automatic install-time credential theft and exfiltration chain, not functionality aligned with an API gateway utility. The deliberate delays and environment guards further supp...

This is concrete automatic credential collection and exfiltration, unrelated to the stated order-management functionality. The postinstall hook makes the behavior run without an explicit...

The package deliberately transfers authentication credentials to hard-coded external Vercel applications during normal page use. There is no install-time hook abuse, but the runtime crede...

The automatic lifecycle hook persists a new CI workflow in consumer repositories and causes future network reporting to an external registry. This is unconsented install-time project muta...

The package contains a complete automatic remote-payload execution path, not merely an optional download helper. Its default stealth-browser deployment gives an external latest-release ar...

This is a concrete, automatically triggered credential-exfiltration payload disguised behind inert exports. The behavior is malicious and warrants blocking publication.

This is an unconsented install-time credential theft and exfiltration payload. The postinstall trigger makes the attack reachable without any package API call.

The source establishes an automatic path from workflow environment secrets to a fixed remote endpoint. Lack of an install hook limits the trigger but does not remove the concrete credenti...

This is a concrete automatic install-time credential-exfiltration chain, not package-aligned setup. The package should be blocked.

This is an automatic install-time remote code staging chain with later execution, not merely a user-invoked CLI action. The narrow .bohr destination and lack of secret harvesting reduce s...

The package has an automatic install hook that fetches and executes opaque native code and then automatically refreshes AI-agent integrations. Hash verification does not establish the saf...

This is an unconsented postinstall mutation of both a consumer project and an existing user-level AI-agent control surface. The automatic registration is concrete and sufficient for a pub...

The executable contains a complete, default-enabled runtime path that uploads environment secret values to a hardcoded third-party host using GitHub Actions identity. This is concrete cre...