npm security reports, with evidence.

The package implements default-on transmission of identifiers derived from foreign Codex/Claude authentication files, rather than using only its own anonymous identifier. Hashing does not...

The package has a concrete lifecycle-triggered AI-agent control-surface mutation chain, including remote-sourced content. This meets the block boundary despite no observed credential exfi...

The automatic postinstall mutates broad, foreign AI-agent control surfaces and can introduce remotely refreshed instructions. This meets the block boundary regardless of otherwise legitim...

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, including remotely refreshed instruction content. It meets the firewall block boundary despit...

The lifecycle hook performs both remote content acquisition and broad global AI-agent configuration writes without an explicit setup command. This satisfies the install-time foreign/broad...

OpenSSF/OSV malware advisory MAL-2026-14116 blocks this version. The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-14116 blocks this version. The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 (npm) as malicious.

OpenSSF/OSV malware advisory MAL-2026-6590 blocks this version. On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE execu...

OpenSSF/OSV malware advisory MAL-2026-6590 blocks this version. On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE execu...

OpenSSF/OSV malware advisory MAL-2026-6590 blocks this version. On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE execu...

The automatic default redirection of Codex app-server traffic to an unrelated external provider is a concrete data-exfiltration chain, not merely a user-selected custom endpoint. The post...

The install-time replacement of a broadly named Codex launcher is a concrete unconsented AI-agent control-surface mutation. No network or credential theft was found, but the launcher hija...

The source establishes a concrete automatic persistence and configuration-mutation chain in an upstream Grok home, not merely a scanner signature. Lack of direct exfiltration does not mit...

Concrete postinstall mutation of ~/.cursor/skills and ~/.cursor/mcp.json meets the block boundary for unconsented foreign AI-agent control-surface writes. Checksum validation does not mit...

Direct source inspection confirms unconsented postinstall mutation of global Claude and Codex controls, including executable lifecycle configuration. This meets the blocking policy regard...

The install hook performs concrete global AI-agent configuration and lifecycle mutations, exceeding package-local setup. Runtime LLM networking is not needed for the block decision.

Source inspection confirms an automatic postinstall chain that modifies global Claude/Codex configuration and registers a Node notify hook. This meets the blocking policy for unconsented...

Source inspection confirms install-time replacement of the global `codex` command rather than ordinary package-local setup. No exfiltration was found, but the concrete CLI hijack meets th...

This is concrete install-time delivery and persistence of a native executable with explicit security-control bypass behavior. The bundled checksum provides integrity only relative to the...

The automatic postinstall writes a persistent Claude Desktop MCP command without user invocation or consent. This meets the install-control-surface blocking criterion regardless of the pa...