npm security reports, with evidence.

The package executes a bundled native payload at import time, and its embedded credential, exfiltration, and persistence indicators establish a concrete malicious chain. Absence of an npm...

This meets the blocking policy: a postinstall hook automatically mutates detected third-party AI-client MCP configurations. Remote executable installation and persistent LaunchAgent setup...

The package's advertised TOTP code is coupled to concrete credential theft, remote exfiltration, and unsolicited payload installation. These behaviors execute automatically at install tim...

The package performs an unconsented postinstall mutation of foreign AI-agent configuration and defines a default agent routed through its relay. The global-install guard limits exposure b...

The automatic postinstall mutates foreign/broad AI-agent control surfaces and host configuration, meeting the blocking policy. Opt-outs and global-install gating do not establish consent.

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, which meets the blocking policy. The global-install guard and opt-outs do not restore inform...

This is a concrete npm postinstall mutation of broad, foreign AI-agent configuration surfaces, including an executable Codex notify hook. The inspected runtime LLM networking is not neede...

This is concrete, unconsented install-time metadata exfiltration, regardless of its claimed research purpose. The DNS encoding and redundant callback channels make the behavior an active...

Concrete postinstall writes target global Claude and detected Codex control surfaces rather than a package-owned directory. This meets the firewall block policy for unconsented install-ti...

This is concrete install-time credential exfiltration plus remote payload placement, unrelated to TOTP functionality. The benign API is a cover and also activates the malicious runner.

The package contains a concrete automatic third-party forwarding path for inbound photo attachments, plus unsolicited import-time dependency mutation. These are materially beyond the adve...

The package implements a concrete install-time data-exfiltration chain, regardless of its stated research purpose. Its limited scope does not remove the unconsented collection and externa...

This is concrete install-time credential exfiltration and payload deployment unrelated to a TOTP utility. The behavior is stealth-oriented and activated without user consent.

This is a concrete install-time credential-stealing and payload-dropping chain unrelated to TOTP functionality. The delayed, swallowed-error postinstall increases stealth.

Source confirms the concrete postinstall control-surface mutation. The .claude-exists check is not a package-ownership or explicit-consent gate.

Source confirms automatic preinstall execution and external transmission of identifying host and project data. The stated research purpose does not remove the concrete unconsented exfiltr...

Source establishes both storage of WhatsApp authentication material in a shared external database and remote file replacement authority for a hardcoded non-installer identity. These are c...

Source inspection confirms a lifecycle-triggered download-and-execute chain, not merely suspicious primitives. Opt-out environment flags do not make the default unprompted behavior safe.

This is concrete install-time credential theft and unauthorized payload installation, unrelated to TOTP utilities. The legitimate TOTP API is a cover and also triggers the malicious routine.

This is concrete credential forwarding to an undisclosed third-party endpoint, not merely an unused dependency or generic network capability. Although it is UI-triggered rather than insta...

Source confirms credential and environment transmission to a hard-coded external endpoint during the default enabled execution feature. There is no lifecycle persistence, but the concrete...