npm security reports, with evidence.

This is unconsented install-time collection and remote transmission of host-identifying information. The duplicate lifecycle callbacks and suppressed failures make it concrete malicious i...

The global-only guard limits scope, but it does not make the automatic writes to ~/.codex/config.toml and a default agent user-invoked. This is a concrete postinstall AI-agent control-sur...

This package performs unconsented, automatic install-time transmission of host-identifying data to an unrelated endpoint. The behavior is concrete exfiltration and warrants blocking.

The package performs unconsented install-time collection and transmission of local host metadata to an unrelated external endpoint. The benign runtime placeholder does not justify or miti...

Direct source inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project identifiers to an unrelated endpoint. The benign placeholder entrypoint does not...

Direct inspection confirms two automatic lifecycle hooks that silently exfiltrate host and project metadata to an external endpoint. The runtime entrypoint is inert, so the harmful behavi...

The automatic postinstall hook makes broad, persistent changes to multiple global AI-agent control surfaces and the consumer project. This meets the install-hook abuse policy even though...

OpenSSF/OSV malware advisory MAL-2026-15573 blocks this version. The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the instal...

OpenSSF/OSV malware advisory MAL-2026-15572 blocks this version. On `npm install`, package.json's preinstall hook (`node preinstall.js || true`) auto-runs a script that (1) enumerates pro...

OpenSSF/OSV malware advisory MAL-2026-15571 blocks this version. grafeno-billing@1.0.0 is a stub package whose only substantive code is a preinstall lifecycle hook. On npm install, preins...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, including recursive deletion within its installed skill directories. The bridge’s deliberate permi...

This release automatically writes and prunes user-level skills for two unrelated AI-agent platforms during postinstall, rather than requiring an explicit setup command. The added runtime...

This is an unconsented install-time mutation of global and project AI-agent control surfaces, including permissions of existing agents. The absence of exfiltration does not offset the con...

Source inspection confirms an automatic postinstall chain that mutates third-party AI client configuration and host security settings. This meets the policy threshold for malicious instal...

The package performs concealed, unconsented external account mutation on every authenticated connection and combines it with vendor fingerprinting and remote feature revocation. The lifec...

The source implements silent, automatic remote collection of browser logs and confirms that normal mail composition logs sensitive metadata. The benign workspace-linking postinstall hook...

This package contains a concrete, automatic runtime exfiltration path to a third-party host. The benign package-local postinstall symlinks do not mitigate that behavior.

The package contains a direct runtime path that serializes sensitive IMAP configuration and sends it to an unrelated remote logging endpoint. This is concrete credential exfiltration, des...

This package performs an unconsented postinstall mutation of a broad foreign AI-agent control surface. That behavior meets the install-control-surface blocking policy despite the absence...

The CLI combines ordinary first-run credential collection with a hard-coded external gateway and persistent credential storage. This is concrete credential-routing behavior, not a noisy s...

The package performs unconsented postinstall mutation of foreign, user-level AI-agent control surfaces. This is concrete install-hook abuse even though no external exfiltration endpoint w...