npm security reports, with evidence.

The package performs concrete, unconsented persistence and broad AI-agent control-surface changes, then provides an automatic self-update path to another lifecycle-enabled release. These...

The package implements an automatic telemetry exfiltration path from its user-facing CLI, including failure details that can contain sensitive project information. Although it has no inst...

The automatic postinstall path modifies global Codex configuration and installs session-start execution hooks. This is an unconsented install-time mutation of a broad AI-agent control sur...

The lifecycle path performs broad, automatic project-level AI-agent configuration and establishes later hook execution. The absence of observed secret theft does not remove this concrete...

The package has no install lifecycle hook, but its normal collab init command silently starts a background collector that overrides an explicit privacy default and uploads local AI transc...

This is concrete remote script execution and browser-data exposure, not merely a bundled model runtime. The lack of an automatic npm install hook reduces installation risk but does not ne...

The hard-coded non-package gateway is automatically selected and receives authentication and database credential material. The lack of installation hooks limits the trigger but does not r...

The automatic postinstall, runtime self-dependency on a different release range, broad consumer mutation, agent-control changes, and detached re-execution meet the lifecycle self-dependen...

The package contains a concrete automatic postinstall chain that globally installs a separate AI-agent package. The conditional and opt-out do not establish consent for this installation-...

The postinstall hook unconsentedly persists mandatory package instructions into OpenCode's configuration. This concrete agent-control mutation warrants blocking.

The package has a concrete postinstall path that automatically installs a foreign global AI-agent package. This meets the install-control-surface blocking policy even though no separate s...

This is unconsented postinstall mutation of foreign AI-agent control surfaces, coupled with installed behavior directives and automatic global updating. The global-only gate does not remo...

This is an unconsented postinstall mutation of foreign AI-agent control surfaces, compounded by code that prefers permission bypass. The behavior meets the install-control-surface block p...

The package has a concrete automatic postinstall chain that mutates DSH agent configuration and registers executable plugin code. Its later credentialed external image transmission compou...

The install hook performs an unconsented global mutation of a foreign AI-agent control surface. The detection guard and opt-out variable do not make this automatic lifecycle action user-c...

This is an automatic postinstall mutation of broad, foreign AI-agent control surfaces, including enabling a Codex plugin. The behavior meets the install-control-surface block policy regar...

This package contains a complete, default-enabled runtime data-exfiltration path to hard-coded external webhooks. It is not install-time malware, but the undisclosed receiver and automati...

This is an unconsented install-time mutation of broad AI-agent control surfaces combined with deliberate review suppression and secret-handling instructions. The behavior meets the instal...

This is concrete credential exfiltration to a package-controlled third-party endpoint, activated by the package's core login flow. The automatic project-level updater increases supply-cha...

This package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and the consumer project. That concrete lifecycle behavior meets the publish-block polic...

The source implements a concrete credential-exfiltration path to a non-Facebook endpoint and an enabled-by-default runtime updater that changes the consumer project. These behaviors occur...