npm security reports, with evidence.

This is a concealed, remotely controlled redirect and query-forwarding mechanism, not a legitimate npm package function. It has no install hook, but its runtime behavior is concrete malic...

The package has no install-time lifecycle hook, but its included CI path automatically transfers credentials to a fixed external endpoint and executes remote hydrated definitions with tho...

This is a concealed remote-code-execution loader embedded in the package's import path, with self-removal intended to hide the compromise. The lack of an npm lifecycle hook does not mitig...

The code contains an automatic remote command channel whose EVAL_CODE action directly executes attacker-supplied JavaScript. The lack of an npm lifecycle hook does not mitigate this concr...

The automatic global installation of a separate AI-agent CLI and persistent user configuration mutation are concrete install-hook abuse. No secret exfiltration was found, but the unconsen...

The package performs automatic environment capture during installation with no legitimate package functionality present. Although no exfiltration endpoint is included, the install-time co...

The package automatically harvests environment data during installation and uses an obfuscated network command. Its runtime self-dependency selects a different release, making this a mali...

The manifest contains a concrete automatic postinstall exfiltration command. Its environment collection and remote transmission are malicious regardless of the absent main entrypoint.

The package has a concrete, intentional host-identity exfiltration path when its CLI or main entrypoint runs. Lack of an install hook limits the trigger but does not make the behavior ben...

The package has a concrete automatic postinstall mutation of a foreign OAuth callback page. Under the lifecycle control-surface policy, this warrants blocking despite the lack of demonstr...

This is an unconsented postinstall mutation of a foreign AI SDK's sign-in-adjacent control surface. Although the script has no observed exfiltration or network behavior, its automatic dep...

The automatic postinstall hook modifies a foreign OAuth callback asset rather than only package-owned files. Under the install-control-surface policy, this concrete unconsented mutation w...

The package has a concrete postinstall hook that rewrites a foreign AI SDK OAuth callback page. This meets the install-control-surface block boundary despite the absence of shown secret t...

The package performs an automatic, persistent rewrite of a foreign dependency's OAuth callback UI during postinstall. That concrete tampering outweighs the absence of demonstrated data th...

The package has a concrete automatic postinstall chain that installs and activates a persistent plugin in a separate user agent environment. The absence of observed network exfiltration d...

The package uses postinstall to install and activate a bundled plugin in another application's user-wide plugin directory. That automatic foreign control-surface mutation meets the instal...

The automatic postinstall chain silently changes Claude Code's user-level agent configuration and installs additional MCP capabilities. This meets the blocking policy for unconsented life...

The automatic lifecycle chain makes broad user-level AI-agent configuration changes and MCP registrations. This meets the policy for unconsented postinstall mutation of a foreign AI-agent...

This is a concrete install-hook supply-chain mechanism, not a normal transparent setup step. It remotely replaces executable package code and package metadata during installation.

This is a covert proctoring-evasion and AI-assisted capture tool with persistence and a bundled credential harvester. Its harmless postinstall hook does not mitigate the malicious runtime...

OpenSSF/OSV malware advisory MAL-2025-6396 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored...