npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-10160 blocks this version. On require of the main entry `dist/index.js`, the module decodes a base64 literal to the shell command `npm install vector...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-6372 blocks this version. Package name mimics the legitimate `rollup-plugin-polyfill-node` and copies its source (the repository field in package.jso...

OpenSSF/OSV malware advisory MAL-2026-14361 blocks this version. On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home d...

The lifecycle hook performs unconsented, broad consumer-project AI-agent and hook configuration. This meets the firewall's install-time AI-agent control-surface block boundary despite col...

Direct source inspection confirms an install-time write to global Claude Code hooks, not merely a scanner signature. The PATH guard limits exposure but does not make the unconsented broad...

The lifecycle hook performs automatic, persistent consumer-repository AI-agent control-surface mutation. This meets the firewall block boundary regardless of the apparent developer-toolin...

The package performs a concrete, unconsented, install-time overwrite of a foreign project file. Other flagged primitives are framework functionality and do not mitigate this destructive l...

The source establishes an unconsented postinstall chain that installs a foreign AI-agent CLI globally and persists user-environment changes. This meets the blocking boundary for install-t...

The package performs unconsented postinstall mutation of foreign, global AI-agent control surfaces. This meets the blocking policy regardless of the scanner's similarity labels.

The package performs unconsented postinstall mutation of the consuming project's Claude Code configuration surface. Opt-outs and the absence of observed exfiltration do not remove that co...

The concrete postinstall chain writes global Claude/Codex control surfaces and registers executable lifecycle behavior. This meets the install-control-surface blocking boundary.

The automatic global replacement of an existing AI-agent command by an @codexed package is a concrete unconsented control-surface hijack. No exfiltration was found, but it is not required...

This is concrete default runtime data exfiltration to embedded third-party webhook recipients, not an inert networking primitive. The absence of an install hook limits the trigger to use...

This is concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces. The lack of observed network exfiltration does not mitigate the persistent control-surface...

Direct source inspection confirms a reachable preinstall reconnaissance and data-exfiltration chain. This is concrete unconsented install-time behavior, independent of the package's state...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Explicit later setup and trust-review guidance does not mitigate the...

Source confirms an install-time overwrite of the global `codex` command, a broad AI-agent control surface. No separate exfiltration is required for this concrete command-hijacking chain.

The package delivers an obfuscated tracking/proxy application under an SVG package identity and activates it on rendering. Its concealed fingerprinted requests create a concrete data-exfi...

The postinstall creates persistent global Codex configuration and a notify execution path without an explicit user setup command. Conditional detection and some preservation guards do not...