npm security reports, with evidence.

This is an unconsented postinstall mutation of foreign AI-agent control surfaces through an unverified remote payload. The source directly establishes the installation and execution chain.

This is concrete, unconsented preinstall-time data exfiltration through multiple external channels. The package has no legitimate runtime function beyond the beacon.

The package’s install hook performs unprompted remote-code installation and alters the broad, foreign Codex agent surface. This meets the blocking policy despite vendor-aligned endpoints....

Although there is no install lifecycle hook, explicit CLI setup creates a concrete remote-code-execution and persistence chain and mutates a foreign AI-agent configuration surface. The so...

This is not a normal icon/SVG package: it deploys a persistent browser proxy and forwards session cookies through its transport. The absence of npm lifecycle hooks limits install-time imp...

Source confirms unconsented runtime account mutation and remote fingerprint attestation, activated by normal package use. This is concrete malicious behavior, not a scanner-only indication.

This is an unconsented postinstall chain that executes an opaque downloaded binary to alter Codex and Claude Code hook surfaces. It meets the blocking boundary for foreign AI-agent contro...

The package performs concealed, unconsented modification of a foreign project manifest during postinstall. No network or credential theft was found, but dependency injection alone is conc...

The source intentionally conceals a default endpoint inconsistent with its documented branding and transmits caller data plus authorization to it. This establishes malicious credential an...

Intentional endpoint concealment plus a runtime mismatch with advertised service metadata creates a concrete credential-and-prompt exfiltration path. It is user-call-triggered, but the de...

The automatic startup update path redirects the installed package's trust boundary to a conflicting foreign npm identity and executes the resulting updater. This is concrete unconsented r...

Source establishes concealed remote control and unconsented account actions during ordinary runtime initialization. Absence of lifecycle hooks does not mitigate the concrete runtime behav...

The package’s postinstall creates or updates a Claude Code skill outside its own installation directory and explicitly states it activates in future conversations. The guard and opt-out d...

This is concrete, unconsented preinstall-time host and project metadata exfiltration to a fixed third-party callback. A stated research purpose does not remove the install-time disclosure.

The source implements automatic preinstall-time collection and external transmission of identifying host and project data. Its stated research intent does not remove the concrete unconsen...

The package executes automatically during installation and exports identifiable host, network, path, and project metadata to a fixed third-party callback. Its stated research purpose does...

Direct source inspection confirms automatic preinstall execution and multiple outbound channels carrying collected host and consumer-project metadata. The declared dependency-confusion Po...

The package implements a concrete credential-exfiltration chain to a hard-coded third-party endpoint, including an automatic configured-credential path. Absence of install hooks does not...

Source inspection confirms a postinstall hook that overwrites a pre-existing global Codex launcher, rather than relying on package-manager-owned bin linking. That creates a concrete broad...

The package performs unconsented install-time mutation of a broad AI-agent command control surface, including deletion of any existing launcher. No exfiltration is needed for this concret...