npm security reports, with evidence.

Direct source inspection confirms a reachable preinstall reconnaissance and data-exfiltration chain. This is concrete unconsented install-time behavior, independent of the package's state...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Explicit later setup and trust-review guidance does not mitigate the...

Source confirms an install-time overwrite of the global `codex` command, a broad AI-agent control surface. No separate exfiltration is required for this concrete command-hijacking chain.

The package delivers an obfuscated tracking/proxy application under an SVG package identity and activates it on rendering. Its concealed fingerprinted requests create a concrete data-exfi...

The postinstall creates persistent global Codex configuration and a notify execution path without an explicit user setup command. Conditional detection and some preservation guards do not...

This is a concrete, automatic postinstall write into a foreign project-level AI-agent control surface. Although no exfiltration or remote execution was found, the lifecycle mutation meets...

The install hook deliberately overwrites an existing global AI-agent command rather than relying on npm's normal bin linking. That is a concrete unconsented control-surface hijack.

The package automatically performs broad host and project metadata collection during preinstall and exfiltrates it to a third-party callback. Its stated research purpose does not provide...

The package performs concrete, unconsented install-time collection and external exfiltration of system and project data. Its stated research purpose does not remove the active data-exfilt...

This is concrete, unconsented install-time reconnaissance and exfiltration from the consuming environment. Research-oriented labels do not remove the external data-transfer attack surface.

This is concrete unconsented preinstall-time data exfiltration from the consuming environment through multiple external channels. The absence of credential theft or persistence does not m...

The verified install-time chain performs unconsented hosts-file/DNS mutation and drops launch artifacts. This is concrete harmful behavior, not merely a user-invoked installer.

The package executes a bundled native payload at import time, and its embedded credential, exfiltration, and persistence indicators establish a concrete malicious chain. Absence of an npm...

This meets the blocking policy: a postinstall hook automatically mutates detected third-party AI-client MCP configurations. Remote executable installation and persistent LaunchAgent setup...

The package's advertised TOTP code is coupled to concrete credential theft, remote exfiltration, and unsolicited payload installation. These behaviors execute automatically at install tim...

The package performs an unconsented postinstall mutation of foreign AI-agent configuration and defines a default agent routed through its relay. The global-install guard limits exposure b...

The automatic postinstall mutates foreign/broad AI-agent control surfaces and host configuration, meeting the blocking policy. Opt-outs and global-install gating do not establish consent.

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, which meets the blocking policy. The global-install guard and opt-outs do not restore inform...

This is a concrete npm postinstall mutation of broad, foreign AI-agent configuration surfaces, including an executable Codex notify hook. The inspected runtime LLM networking is not neede...

This is concrete, unconsented install-time metadata exfiltration, regardless of its claimed research purpose. The DNS encoding and redundant callback channels make the behavior an active...

Concrete postinstall writes target global Claude and detected Codex control surfaces rather than a package-owned directory. This meets the firewall block policy for unconsented install-ti...