npm security reports, with evidence.

The lifecycle hook concretely modifies consumer AI-agent and Git control paths, rather than merely exposing an explicit setup command. No exfiltration was found, but the unconsented posti...

Direct source inspection confirms automatic transmission of runtime environment secrets to a fixed external endpoint. The lack of install-time execution does not remove the concrete crede...

The source implements an authenticated upload of environment-derived secret values to a hard-coded external host. No install hook exists, but the runtime data flow is concrete and unsafe.

The published CommonJS entrypoint contains a concealed, hash-gated payload launcher with detached child-process execution. The lack of lifecycle hooks does not mitigate runtime execution...

OpenSSF/OSV malware advisory MAL-2026-14216 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. package.json declares `postinstall: node apps`, whic...

The import-time IP-harvesting and Slack submission chain is directly present in package source and reachable through an exported entrypoint. This is malicious behavior despite the absence...

The install-time decryption and detached execution chain is concrete arbitrary-code execution behavior, not a benign static primitive. Absence of the staged file does not neutralize the m...

Source directly implements clipboard and screenshot upload to a remote endpoint, with concealment features. The absence of an install hook limits automatic activation but does not remove...

This is concrete, default-on postinstall mutation of multiple foreign/broad AI-agent control surfaces. That meets the firewall block boundary despite no observed credential exfiltration i...

The package performs unconsented postinstall mutation of foreign and broad AI-agent control surfaces, including a fallback that creates one. This meets the firewall block policy despite n...

The package concretely performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and weakens tool-approval settings. This meets the firewall block boundary reg...

Source inspection confirms an automatic postinstall mutation of global Claude Code and Codex MCP configuration. This is a concrete unconsented foreign/broad AI-agent control-surface write.

The embedded active webhook configuration and automatic runtime POST path establish concrete unconsented data exfiltration. The lack of an install hook does not mitigate this runtime beha...

The unguarded postinstall write to multiple foreign global AI-agent skill locations meets the firewall block criterion. The remote executable download increases impact but is not needed f...

The package contains hardcoded externally controlled webhook destinations that are enabled by default for runtime features and transmit serialized application records. This is concrete da...

This is a concrete, default-enabled runtime data-exfiltration path to hard-coded external recipients, not merely configurable application telemetry. The absence of install hooks does not...

OpenSSF/OSV malware advisory MAL-2026-14300 blocks this version. The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hoo...

OpenSSF/OSV malware advisory MAL-2026-14301 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. The package advertises EVM address validation but pe...

Source confirms an automated credential upload path, not merely network or environment-variable use. Lack of npm lifecycle hooks does not mitigate the generated CI workflow's secret exfil...

The digest check limits transport tampering but does not mitigate the package's explicit purpose of bypassing OS trust warnings for an unsigned remote binary. This is concrete malicious i...