npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6185 blocks this version. On `npm install`, postinstall.js unconditionally reads the installer's `~/.npmrc` (which typically contains `//registry.npm...

The package has no observed exfiltration, but its automatic postinstall changes consuming-project lifecycle policy and injects broad agent instructions plus review-suppression rules. This...

The package contains a concrete, Hub-triggered export of an E2EE master key that conflicts with its security claims. This is not install-time behavior, but it is a confirmed credential/pr...

Source confirms a concrete install-time global installation of a foreign AI-agent CLI. The conditional check does not provide user consent for that mutation.

The install hook itself is limited, but the user-invoked runtime contains an unchecked remote executable download-and-execution chain. This is concrete remote payload execution, not merel...

Source confirms a concrete postinstall chain that persists hooks/extensions across third-party AI-agent environments and relays agent activity. This meets the block policy regardless of t...

Source confirms an unconsented postinstall chain that modifies both Codex-style and Claude agent configuration and installs a blocking lifecycle hook. This meets the firewall block bounda...

This is concrete, unconsented install-time credential/configuration exfiltration. The endpoint is intentionally concealed and the lifecycle hook suppresses errors.

The package contains no npm lifecycle hook, but its sole shipped entry is an intentionally obfuscated server-directed redirector behind a fake verification UI. The concealed remote destin...

The package contains reachable import-time targeted browser disruption and forced remote audio playback. No install hook is needed for the malicious runtime behavior.

The source establishes a concrete credential-harvesting and remote-authentication chain, not merely support for user-provided environment keys. Although execution is CLI-invoked and there...

Source inspection confirms a credential-harvesting extension with broad site access and a hard-coded external default endpoint. The user confirmation does not remove the concrete remote c...

Direct inspection confirms a concealed staged-payload loader with eval and detached process execution in the ESM runtime path. Absence of lifecycle hooks does not mitigate this applicatio...

The package contains a concrete, obfuscated import-time remote payload execution chain. Lack of npm lifecycle hooks does not mitigate the ESM import path.

The source confirms automatic lifecycle execution and external DNS transmission of host-derived data. The inert runtime export does not mitigate the install-time behavior.

The package contains an automatic install hook with concrete secret disclosure and filesystem persistence. The absence of network code does not remove the install-time credential-harvesti...

The ESM runtime entry contains a concrete concealed payload-execution chain, not merely suspicious primitives. Lack of lifecycle hooks does not mitigate import-time arbitrary execution.

The appended Babel-config payload is unrelated to asset extraction and contains an explicit remote code-execution chain. Absence of install hooks reduces automatic-install exposure but do...

The obfuscated tooling payload has a concrete remote-code-execution chain and detached-process launch, unrelated to the declared package function. Absence of an install hook limits automa...

This is a concrete, unconsented postinstall secret-exfiltration chain, not a package-aligned configuration helper.