npm detections from LPM Firewall.

The sole entrypoint sends machine identity to an unrelated oast.fun callback and contains no StoreKit functionality. That is concrete data exfiltration even though a variable typo and mod...

The package's only runtime behavior is an automatic request that sends the machine hostname and OS platform to an unrelated oast.fun callback. That is concrete import-time data exfiltrati...

The active Android bundle automatically sends account metadata to an unrelated logging host without an effective consent gate. This is concrete data exfiltration.

The MCP handler sends environment values to the fixed portal and executes a command taken from that response, while the launcher can background-install a newer global release. That is rem...

The default portal is operator-controlled, and the MCP install tool executes that portal's install_command while forwarding env_vars. That is remote command execution reached through the...

Postinstall unconditionally installs a native binary and mutates config.toml in the official Grok home while the package identity is @kingingwang, not @xai-official. That is unconsented i...

The automatic postinstall hook performs concrete, broad mutations of foreign AI-agent dependencies and obscures them by deleting source maps. No network exfiltration was needed to establi...

The automatic lifecycle hook makes broad, persistent changes to third-party AI-agent controls and installs a Codex plugin. This is concrete install-hook abuse under the stated policy.

The postinstall path unconditionally launches a global skills install into home directories shared by AI agents, with the yes flags set and stdio piped. That is unconsented mutation of a...

The distributed CLI contains concealed conversation collection and upload behavior outside the stated rule-download purpose. The opt-out-only control and obfuscation make the runtime tran...

The postinstall hook fetches native binaries from a CDN and makes them executable, using a checksum served by the same host, including static.jingyunyilian.com. The published server then...

The automatic lifecycle chain performs concrete writes to foreign AI-agent skill directories. The bundled implementation is also obfuscated, reducing auditability of this install-time beh...

The automatic postinstall chain reaches code that writes to the .agents AI-agent control surface. This is concrete install-hook abuse under the stated policy, despite the write being scop...

The automatic lifecycle hook performs broad, unconsented mutation of foreign AI-agent directories. This meets the install-control-surface policy for blocking publication.

This is active, unconsented account manipulation combined with obfuscated policy code and remote device telemetry. The behavior is concrete and executes during normal authenticated use.

The plugin silently detaches a native stage0 binary whose embedded profile inventories the home directory, forwards the process environment, and contacts unrelated skyleen.fr control serv...

The automatic postinstall chain modifies global Claude configuration, installs event hooks, and adds an MCP server without an explicit user setup action. This meets the install-hook abuse...

OpenSSF Malicious Packages via OSV confirms z-deno-truth-bwhlsz@2.0.0 as malicious (MAL-2026-16470): Malicious code in z-deno-truth-bwhlsz (npm)

The package has no product behavior beyond an install hook that phones home host identity to webhook.site. That unsolicited exfiltration on install is concrete attack behavior.

OpenSSF Malicious Packages via OSV confirms some-tool-package@99.0.0 as malicious (MAL-2026-16455): Malicious code in some-tool-package (npm)

OpenSSF Malicious Packages via OSV confirms ndmckauxuoincv@1.0.0 as malicious (MAL-2026-16401): Malicious code in ndmckauxuoincv (npm)