npm security reports, with evidence.

Source confirms a default third-party credential relay in the primary login path. Absence of lifecycle hooks does not mitigate the concrete credential-exfiltration behavior.

The package’s primary login path sends credentials to an unrelated hard-coded endpoint rather than Facebook. This is concrete runtime credential exfiltration, not merely a suspicious prim...

The package performs unconsented postinstall mutation of a consumer repository's broad AI-agent control surface. Project and home-directory guards reduce scope but do not make this instal...

This is an unconsented postinstall mutation of broad third-party AI-agent hook configuration. It meets the firewall block policy even though the JavaScript itself does not harvest credent...

The unused import-time obfuscated payload is concrete malicious concealment and reaches runtime through the package main entrypoint. Absence of lifecycle hooks does not mitigate import-ti...

The package implements concrete background persistence and collection/upload of AI transcript-derived data on ordinary CLI execution. The lack of an npm install hook reduces propagation r...

The package contains a concrete credential-exfiltration path: sensitive runtime tokens are passed to a hardcoded external telemetry receiver. Absence of lifecycle hooks limits the trigger...

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, compounded by remote native-binary execution and privileged host configuration. Global-insta...

Concrete import-time staged payload execution is present, even though no install hook exists. The dynamic HTTP transport is not needed for the verdict.

Source establishes a default third-party receiver and a direct credential/2FA POST reachable from the normal login path. The absence of install hooks does not mitigate this runtime creden...

Source directly confirms credential exfiltration to a package-configured third-party endpoint during the normal login path. No install hook is needed for this concrete runtime attack.

The package implements a default-enabled flow that forwards Facebook credentials to an unrelated hard-coded external host, establishing concrete credential exfiltration at normal runtime....

This is concrete install-time persistence combined with network-reachable arbitrary command execution and remote script execution. It exceeds a package-aligned local relay because these h...

Direct source inspection confirms an automatic global installation of Anthropic's AI-agent CLI plus persistent PATH mutation during postinstall. This meets the block boundary for unconsen...

The lifecycle-triggered installer creates persistence and starts a LAN-exposed bridge whose local/exec handler runs supplied commands without authorization. This is concrete attack behavi...

The package contains a concrete concealed remote redirect chain behind a security-verification facade. It is not install-time malware, but its runtime behavior is malicious.

The shipped runtime contains default, non-placeholder external logging endpoints and automatically sends rich application records after initialization. This is a concrete default data-exf...

OpenSSF/OSV malware advisory MAL-2026-14393 blocks this version. Package sm-admin@99.0.0 defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardc...

The package has a concrete unconsented postinstall chain that mutates broad AI-agent skill locations. Global-only and opt-out guards do not provide user consent for the lifecycle mutation.

Source directly implements remote transmission of sensitive interactive-command and identity data, not merely package-aligned challenge submission. The absence of an install hook does not...

The package’s own source establishes an install-time chain from remote executable download to automatic Codex/Claude hook setup. That matches the blocking policy even though the JavaScrip...