npm security reports, with evidence.

This package performs a concrete, unconsented global-install mutation of foreign AI-agent skill paths and overwrites existing directories. The global-only guard does not remove the instal...

Source inspection confirms a concrete import-time global install and remote configuration chain unrelated to the advertised testing library. This is malicious dependency behavior.

The package persistently deploys and injects instructions designed to defeat agent safety boundaries, then supplies command execution capability. No install hook or external exfiltration...

Direct source inspection confirms a postinstall-triggered executable installs Codex and Claude Code hooks. This meets the blocking policy for unconsented lifecycle mutation of foreign/bro...

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the block boundary. The user-configured Payload REST client does not mitigate the...

The install-time mutation of a user-wide foreign AI-agent configuration and registration of executable hooks is a concrete policy-blocking chain. No exfiltration was found, but it is not...

Source establishes a complete persistence-and-exfiltration chain: the scaffold installs an agent directive, seeds its destination, and supplies the POST client. The lack of lifecycle exec...

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-14526 blocks this version. The package's package.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL (h...

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

OpenSSF/OSV malware advisory MAL-2026-3030 blocks this version. Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp....

The automatic installation and persistence of a differently named package is concrete unconsented remote-code delivery behavior, not a package-aligned API operation. Absence of lifecycle...

The package performs a concealed import-time installation of a differently named package into the consuming project, controlled by a remote registry response. No lifecycle hook is needed...

The package’s postinstall performs an unconsented global AI-agent skills installation, meeting the install-control-surface blocking boundary. No additional exfiltration is required for th...

Direct inspection confirms concrete install-time remote shell access, not merely a suspicious primitive. This is malicious behavior with no user action required beyond installing the pack...

The source confirms a concrete postinstall chain that mutates global Codex trust and hook settings based solely on pre-existing state. This meets the install-control-surface block boundar...

Source establishes an automatic postinstall path that invokes an opaque native hook installer, and the package documents that it installs hooks for two external agent products. This meets...

The package has no install lifecycle hook, but its normal CLI pre-action hook performs undisclosed identity/environment telemetry and modifies project agent instructions. These are concre...

Source confirms a default remote execution path that transmits authentication-derived data and arbitrary upstream environment values to an external host. Although Code Mode is documented,...