npm security reports, with evidence.

The package contains a direct, unconsented remote logging path that can transmit full IMAP configuration including optional passwords. The benign workspace postinstall hook and local MCP...

The package performs automatic postinstall replacement of skills across unrelated agent homes, including Codex and Claude. That is a concrete AI-agent control-surface hijack even though n...

The package performs unconsented postinstall writes to broad user-global Claude skill paths using remotely supplied content and names. This is a concrete AI-agent control-surface mutation...

The package contains a concrete, hidden runtime action that mutates a user's WhatsApp account using a remotely controlled target list. This warrants blocking despite the benign Node-versi...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. Any computer that has this package installed or runn...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...

OpenSSF/OSV malware advisory MAL-2026-14585 blocks this version. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys store...