npm security reports, with evidence.

The package contains a concrete automatic third-party forwarding path for inbound photo attachments, plus unsolicited import-time dependency mutation. These are materially beyond the adve...

The package implements a concrete install-time data-exfiltration chain, regardless of its stated research purpose. Its limited scope does not remove the unconsented collection and externa...

This is concrete install-time credential exfiltration and payload deployment unrelated to a TOTP utility. The behavior is stealth-oriented and activated without user consent.

This is a concrete install-time credential-stealing and payload-dropping chain unrelated to TOTP functionality. The delayed, swallowed-error postinstall increases stealth.

Source confirms the concrete postinstall control-surface mutation. The .claude-exists check is not a package-ownership or explicit-consent gate.

Source confirms automatic preinstall execution and external transmission of identifying host and project data. The stated research purpose does not remove the concrete unconsented exfiltr...

Source establishes both storage of WhatsApp authentication material in a shared external database and remote file replacement authority for a hardcoded non-installer identity. These are c...

Source inspection confirms a lifecycle-triggered download-and-execute chain, not merely suspicious primitives. Opt-out environment flags do not make the default unprompted behavior safe.

This is concrete install-time credential theft and unauthorized payload installation, unrelated to TOTP utilities. The legitimate TOTP API is a cover and also triggers the malicious routine.

This is concrete credential forwarding to an undisclosed third-party endpoint, not merely an unused dependency or generic network capability. Although it is UI-triggered rather than insta...

Source confirms credential and environment transmission to a hard-coded external endpoint during the default enabled execution feature. There is no lifecycle persistence, but the concrete...

The package has a concrete install-time mutation of a broad, foreign AI-agent control surface. Its conditional guard does not provide meaningful consent for the configuration change.

This is concrete, unconsented postinstall mutation of project AI-agent control surfaces, including automatic installation of third-party plugins. The lack of observed credential theft doe...

The package intentionally routes wallet recovery phrases to an external endpoint through a benign-looking UI control. This is concrete secret exfiltration despite the absence of install-t...

Concrete postinstall-triggered writes alter broad, foreign AI-agent configuration and shell startup surfaces. The absence of a hardcoded receiver does not mitigate the unconsented control...

The install hook performs a destructive, automatic replacement of the global `codex` launcher rather than relying on the package manager's normal bin linking. This meets the install-time...

The explicit confirmation and lack of an npm install hook reduce stealth, but the bundled all-sites credential collector defaults to an unrelated external endpoint and constitutes a concr...

The package performs unconsented postinstall persistence in global Claude Code settings, configuring broad lifecycle hooks that execute other binaries. This meets the install-time AI-agen...

The package performs an unconsented, destructive install-time write to a foreign project file. Other detected dynamic and network-related features are runtime framework functionality and...

The package’s automatic postinstall mutates foreign AI-agent control surfaces and host configuration. This meets the blocking policy for unconsented install-time broad AI-agent control-su...

The concrete, unconsented global postinstall overwrite of the codex AI-agent command is sufficient for blocking. No network exfiltration is needed for this control-surface hijack.