npm security reports, with evidence.

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. No separate exfiltration chain was needed for this verdict.

Source inspection confirms a deceptive executable proxy-site payload in an SVG package, with automatic remote analytics and proxy cookie handling on document rendering. No install hook ex...

Source inspection confirms a package script retrieves and executes an unauditable remote payload. The normal MCP server code does not justify that behavior.

Source directly implements host-project mutation, plaintext transmission of caller identity data, and a fixed-recipient payout flow. The payout behavior is inconsistent with the public co...

The package contains concrete, stealthy postinstall mutation of the consuming project’s dependency manifest. No network exfiltration is needed for this install-hook supply-chain abuse to...

This is a concrete remote-code-execution chain, activated during normal dotenv configuration and concealed by an obfuscated endpoint. It is not install-time, but it is malicious runtime b...

Source shows silent network logging to a non-service endpoint and direct inclusion of sensitive account configuration. This is concrete runtime exfiltration, not a static similarity signal.

The package contains a concrete, automatic credential-bearing telemetry path to a non-mail-service endpoint. No install hook is needed for this runtime data-exfiltration behavior to be ma...

OpenSSF/OSV malware advisory MAL-2026-14318 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares its sole runtime dependency `c...

This contains concrete, unconsented runtime account mutation and host-fingerprint exfiltration, not merely package-aligned WhatsApp functionality. The install hook is local-only but does...

OpenSSF/OSV malware advisory MAL-2026-6579 blocks this version. lessload@1.0.1 impersonates the popular `debug` package (replicating its API surface, contributor list, and description as...

The package has a concrete, manifest-reachable postinstall chain that silently registers hooks in Claude Code settings. Package-aligned telemetry does not remove the unconsented foreign A...

The package has a concrete postinstall persistence chain affecting global Claude Code settings and shell profiles. Although the inspected statusline contains no observed exfiltration, the...

The postinstall chain performs unconsented remote identity/account administration against a fixed external host using embedded default credentials, not merely local development-tool setup...

The import-time payload combines host-data collection and outbound Axios submission with concealed detached process execution. The absence of lifecycle hooks limits the trigger to runtime...

The lifecycle hook performs concrete identity disclosure and remote account mutation using embedded defaults. Its stated developer-tool purpose does not justify automatic transmission of...

The package performs automatic, privileged external account mutation based on a local identity during postinstall, not an explicit user command. Its local configuration and hook writes ma...

This is concrete install-time mutation and data transfer to an external service, not a benign scanner primitive. The fixed remote service, automatic user/password handling, and elevated p...

OpenSSF/OSV malware advisory MAL-2026-12393 blocks this version. On require('invest-module-cookie'), index.js loads _adapter.js which selects an OS-specific asset path, downloads an opaqu...

Source inspection confirms concrete, targeted browser disruption and unsolicited remote audio playback in the package main bundle. This is protestware, independent of the absence of insta...