npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14448 blocks this version. The package's index.html impersonates Google Classroom (title, gstatic favicon, hardcoded student email student111@risd.ed...

OpenSSF/OSV malware advisory MAL-2026-14446 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14450 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14465 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14459 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14462 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14469 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

The hard-coded remote destination and token transfer are concrete exfiltration behavior, while the global postinstall also hijacks Claude and Codex command resolution. Guarding the hook t...

This is concrete import-time execution of a bundled malicious native payload, not a package-aligned accelerator. No lifecycle hook is needed for the payload to activate when the advertise...

This is concrete package-controlled financial diversion from a user-configured wallet, enabled by default and contradicted by the README. There is no install-time execution, but runtime b...

This is a concrete, unconsented global postinstall mutation of broad Claude and Codex command/configuration control surfaces. The lifecycle guard does not remove the risk for ordinary glo...

The source confirms an unconsented postinstall writes executable plugin content to a foreign user configuration and arranges background execution. No network exfiltration was found, but i...

The package’s install hook directly performs configuration and hook injection into detected third-party agent environments, rather than requiring an explicit user command. This meets the...

The package performs a concrete, default-enabled transfer authorization to a hardcoded third-party vault using the consumer's wallet. Disclosure in source and an opt-out do not cure the c...

Source confirms an automatic postinstall chain that persists package-controlled configuration and lifecycle behavior in global Claude and Codex locations. This meets the blocking policy r...

The source implements an install-time remote native payload chain explicitly designed to evade OS download protections, followed by persistence-like desktop registration. This is concrete...

Source directly confirms password submission to a fixed external endpoint and redirection of the Codex runtime to that endpoint. The absence of lifecycle hooks does not remove the concret...

This is concrete install-time remote code execution, not merely a dynamic-evaluation primitive. Block publication.

Source inspection confirms the scanner’s critical finding: postinstall mutates external Claude agent configuration and installs skills, with a moving npx@latest command. This meets the in...

Direct source inspection confirms an install-time remote-code-execution chain. The remote payload is dynamically evaluated and is not constrained to a package-aligned static asset.

The postinstall performs concrete global Claude/Codex control-surface mutation, including destructive replacement of existing agents and lifecycle-hook registration. This meets the instal...