npm security reports, with evidence.

The package's only implemented runtime behavior is unconsented host fingerprint collection and transmission to an unrelated endpoint. This is concrete data exfiltration, despite not runni...

The package contains concrete, unconsented host-identity exfiltration to an unrelated endpoint when its entrypoint runs. This is malicious behavior despite the absence of lifecycle hooks.

The only implemented CLI behavior is covert host-identity exfiltration to an external callback, rather than contract verification. Although it is user-triggered rather than install-trigge...

This is a concrete, obfuscated remote-code loader with an explicit eval and detached process launch. Although it is not install-time, its execution through the package test path is malici...

The automatic lifecycle hook modifies the shared ~/.grok executable and configuration surface, including registry selection. No direct exfiltration is present in the inspected JavaScript,...

The package has no apparent functional purpose beyond sending local host identity data to an out-of-band endpoint. The explicit collection and transmission are concrete malicious behavior...

This is a concealed remote-code-execution loader embedded in a build configuration, unrelated to page asset extraction. The absence of an install hook does not neutralize execution throug...

The code contains a concrete account-takeover primitive disguised as optimization functionality. Although it is not install-time behavior, the deceptive exported routine is malicious.

The package has an automatic postinstall hook that silently overwrites a third-party OAuth callback page. Although the source shows no direct exfiltration, this is an unconsented authenti...

The global-install guard does not make automatic modification of shared Codex routing and agent files user-invoked setup. The update path compounds the risk by automatically reinstalling...

This is a concrete automatic postinstall chain that writes global AI-agent assets and modifies a consumer project. The absence of observed data theft does not neutralize the unconsented c...

The package contains concrete credential and command-input exfiltration tied to an obfuscated exam flow. The lack of install hooks does not remove the runtime privacy and credential risk.

This is an unconsented npm postinstall mutation of broad AI-agent control surfaces. The install path itself establishes concrete persistence risk even without a package-controlled network...

The default remote endpoint plus automatic host cookie-token forwarding creates a concrete credential and data exfiltration path. The lack of install hooks reduces scope but does not remo...

The package has no legitimate implementation beyond collecting and exfiltrating host identity information to an unrelated endpoint. Although it lacks an install hook, its user-invoked exe...

The package has no apparent schema-generation implementation; its only executable harvests host identity information and sends it to an external callback without notice. This is concrete...

The complete automatic lifecycle path modifies both package-manager behavior and multiple foreign AI-agent control files, then suppresses review of those files. The package also contains...

The package performs unconsented installation-time transmission of agent-linked identifiers and host metadata, then stages a remote opaque executable. Pinned hashes mitigate payload subst...

The global-install guard limits scope but does not establish consent for automatic writes to multiple foreign AI-agent control surfaces. The lifecycle hook and installer together meet the...

The package performs an unconsented postinstall mutation of a broad, foreign AI-agent control surface by globally installing opencode-ai. This concrete lifecycle behavior warrants blockin...