npm security reports, with evidence.

Concrete postinstall-triggered writes alter broad, foreign AI-agent configuration and shell startup surfaces. The absence of a hardcoded receiver does not mitigate the unconsented control...

The install hook performs a destructive, automatic replacement of the global `codex` launcher rather than relying on the package manager's normal bin linking. This meets the install-time...

The explicit confirmation and lack of an npm install hook reduce stealth, but the bundled all-sites credential collector defaults to an unrelated external endpoint and constitutes a concr...

The package performs unconsented postinstall persistence in global Claude Code settings, configuring broad lifecycle hooks that execute other binaries. This meets the install-time AI-agen...

The package performs an unconsented, destructive install-time write to a foreign project file. Other detected dynamic and network-related features are runtime framework functionality and...

The package’s automatic postinstall mutates foreign AI-agent control surfaces and host configuration. This meets the blocking policy for unconsented install-time broad AI-agent control-su...

The concrete, unconsented global postinstall overwrite of the codex AI-agent command is sufficient for blocking. No network exfiltration is needed for this control-surface hijack.

This is a concrete, exported remote denial-of-service capability, not merely a noisy static signal. Its runtime invocation requirement does not negate the package’s explicit attack functi...

Source inspection confirmed deliberate reviewer/agent manipulation and propagation into generated artifacts. This warrants blocking despite otherwise package-aligned build behavior.

The package deliberately performs an unconsented, silent import-time installation of a differently named registry package in the consumer project. This is a concrete supply-chain executio...

Direct source inspection confirms automatic writes into ~/.claude/skills and ~/.codex/skills, not merely a user-invoked setup command. This meets the install-time foreign AI-agent control...

This is a concrete staged remote-code-execution chain, not merely a networking or evaluation primitive. Lack of an install hook limits the trigger but does not remove the malicious runtim...

The hard-coded third-party authentication endpoint receives raw user credentials at runtime, which is not required for a local Facebook API client. No install hook is needed for this conc...

The package performs destructive mutations and fingerprint telemetry during postinstall. The global-install gate does not make deletion of potentially unrelated binaries or device trackin...

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code

OpenSSF/OSV malware advisory MAL-2026-14357 blocks this version. The package was found to contain malicious code or consuming dependency that contains malicious code