npm security reports, with evidence.

The package's automatic postinstall installs behavior-bearing hooks and skills into global Claude and .agents locations, not merely its own package directory. This meets the blocking poli...

The advertised server utility embeds an undisclosed global install and stealthy background process launch to a remote API. Although it is runtime-triggered rather than npm lifecycle-trigg...

The package embeds an undisclosed external script and an obfuscated fetch-plus-new-Function loader activated by opening its page. This is a concrete remote code execution surface, not mer...

The source documents and implements an install-time unsigned native payload delivery chain designed to avoid OS security warnings. Bundled checksum validation does not negate the intentio...

Direct source inspection confirms an unconsented postinstall write to global AI-agent skill locations. Collision checks reduce overwrite risk but do not remove the foreign control-surface...

This is concrete runtime data exfiltration, not merely a capability library: clipboard transmission starts automatically when the CLI runs. The absence of an install hook limits install-t...

Runtime execution automatically exfiltrates arbitrary clipboard changes to a remote endpoint and provides screenshot upload through a stealth interface. The absence of lifecycle hooks lim...

The package embeds a concealed, cryptographically gated decrypt-and-spawn chain in its primary Mutex implementation. This is concrete malicious runtime behavior, not an unused static prim...

The package performs concealed import-time remote payload execution unrelated to its declared text-helper functionality. This is concrete malware behavior.

This is an unconsented install-time collection and exfiltration chain targeting the consuming project's .env, with an intentionally hidden destination and silent failure handling.

The source directly constructs a set of environment-secret values and uploads it automatically to a fixed external host. This is credential exfiltration, irrespective of the absence of in...

Direct source inspection confirms both silent install-time data exfiltration and deliberate payment-recipient redirection. These are concrete malicious behaviors, not merely suspicious pr...

This is concrete credential exfiltration to a fixed third-party endpoint, not required for normal Facebook session emulation. The copied example additionally opts into installing a foreig...

This is concrete credential and telemetry exfiltration to a fixed unofficial plaintext endpoint, despite requiring user-invoked setup. No lifecycle hook is needed for the harmful chain on...

OpenSSF/OSV malware advisory MAL-2025-49362 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. At CLI startup, index.js downloads three native shar...

Source inspection confirms the policy-defined blocking behavior: unconsented postinstall mutation of global Claude Code and Codex MCP configuration. The explicit CLI-only hook installer d...

The package performs concrete, unconsented postinstall mutation of the consuming project's dependency manifest through a detached delayed process. No exfiltration was found, but the insta...

The package has a concrete postinstall chain that mutates foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface...

Source establishes automatic upload of real environment-derived secrets to a fixed external receiver during normal CLI execution in GitHub Actions. This is concrete credential exfiltratio...

This is concrete install-time malware, not a package-aligned diagnostic feature: it establishes remote command execution, persistence, and internal credential/service reconnaissance.

The package performs unconsented postinstall mutation of user-global and arbitrary project Claude Code configuration. The guardrails do not remove the broad install-time control-surface w...