npm security reports, with evidence.

Direct source inspection confirms an install-time write to global Claude Code hooks, not merely a scanner signature. The PATH guard limits exposure but does not make the unconsented broad...

The lifecycle hook performs automatic, persistent consumer-repository AI-agent control-surface mutation. This meets the firewall block boundary regardless of the apparent developer-toolin...

The package performs a concrete, unconsented, install-time overwrite of a foreign project file. Other flagged primitives are framework functionality and do not mitigate this destructive l...

The source establishes an unconsented postinstall chain that installs a foreign AI-agent CLI globally and persists user-environment changes. This meets the blocking boundary for install-t...

The package performs unconsented postinstall mutation of foreign, global AI-agent control surfaces. This meets the blocking policy regardless of the scanner's similarity labels.

The package performs unconsented postinstall mutation of the consuming project's Claude Code configuration surface. Opt-outs and the absence of observed exfiltration do not remove that co...

The concrete postinstall chain writes global Claude/Codex control surfaces and registers executable lifecycle behavior. This meets the install-control-surface blocking boundary.

The automatic global replacement of an existing AI-agent command by an @codexed package is a concrete unconsented control-surface hijack. No exfiltration was found, but it is not required...

This is concrete default runtime data exfiltration to embedded third-party webhook recipients, not an inert networking primitive. The absence of an install hook limits the trigger to use...

This is concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces. The lack of observed network exfiltration does not mitigate the persistent control-surface...

Direct source inspection confirms a reachable preinstall reconnaissance and data-exfiltration chain. This is concrete unconsented install-time behavior, independent of the package's state...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Explicit later setup and trust-review guidance does not mitigate the...

Source confirms an install-time overwrite of the global `codex` command, a broad AI-agent control surface. No separate exfiltration is required for this concrete command-hijacking chain.

The package delivers an obfuscated tracking/proxy application under an SVG package identity and activates it on rendering. Its concealed fingerprinted requests create a concrete data-exfi...

The postinstall creates persistent global Codex configuration and a notify execution path without an explicit user setup command. Conditional detection and some preservation guards do not...

This is a concrete, automatic postinstall write into a foreign project-level AI-agent control surface. Although no exfiltration or remote execution was found, the lifecycle mutation meets...

The install hook deliberately overwrites an existing global AI-agent command rather than relying on npm's normal bin linking. That is a concrete unconsented control-surface hijack.

The package automatically performs broad host and project metadata collection during preinstall and exfiltrates it to a third-party callback. Its stated research purpose does not provide...

The package performs concrete, unconsented install-time collection and external exfiltration of system and project data. Its stated research purpose does not remove the active data-exfilt...

This is concrete, unconsented install-time reconnaissance and exfiltration from the consuming environment. Research-oriented labels do not remove the external data-transfer attack surface.

This is concrete unconsented preinstall-time data exfiltration from the consuming environment through multiple external channels. The absence of credential theft or persistence does not m...