npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled id...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

OpenSSF/OSV malware advisory MAL-2026-14586 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package ships two heavily obfuscated JavaScript...

The concrete install-time deletion of existing AI credentials and automatic replacement with a vendor key establishes an AI-agent control-surface hijack. Vendor-aligned networking does no...

The package performs unconsented postinstall mutation of multiple AI-agent configurations and workspace trust state. This meets the firewall block boundary regardless of the scanner simil...

Source establishes a direct path from account credentials to a third-party logging endpoint during ordinary initialization. This is concrete credential exfiltration, not required mail-sto...

The source contains a direct chain from stored account password to an unrelated remote logging endpoint during normal Android initialization. Absence of lifecycle hooks does not mitigate...

The package performs unconsented global postinstall mutation of third-party AI-agent integrations, meeting the blocking control-surface policy. Additional host security changes and unchec...

Source inspection confirms an install-time command that automatically changes Claude Code's user-level skill directory. This meets the blocking policy for unconsented postinstall mutation...

The package performs confirmed postinstall writes to multiple global AI-agent configuration locations. This meets the blocking policy regardless of the absence of confirmed credential exf...

This package contains a concrete credential-exfiltration path: serialized IMAP account configuration is sent to an unrelated remote logging endpoint during normal initialization. Absence...

The package performs unconsented install-time remote shell execution and privileged host mutation. This is a concrete malicious install chain, not merely a user-invoked setup capability.

Source inspection confirms hard-coded external receivers and automatic runtime logging of rich records. This is concrete data exfiltration, despite the absence of an install-time hook.

Source inspection confirms runtime collection and exfiltration of local activity and AI-tool inventory, plus an obfuscated arbitrary shell execution path. The absence of install hooks doe...

Direct source inspection confirms intentional deletion of a foreign root-level script and unsafe broad control-surface changes. These are concrete harmful behaviors despite requiring a CL...