npm security reports, with evidence.

Source establishes a persistent fixed-endpoint credential setup followed by token-bearing network requests. No lifecycle hook mitigates install-time risk, but it does not remove the crede...

OpenSSF/OSV malware advisory MAL-2025-49362 blocks this version. At CLI startup, index.js downloads three native shared libraries (sbx.so, bot.so, v1.so) from https://${arch}.31888.xyz/ (...

The package has a concrete unconsented postinstall chain that rewrites a foreign AI-agent dependency. That meets the install-control-surface block boundary.

The automatic global installation of Anthropic's Claude Code from this unrelated package is a concrete unconsented postinstall mutation of a foreign AI-agent control surface. This meets t...

A covert, encoded prompt is wired into an automatic agent-control path and directs disclosure of sensitive conversational context. No install hook is involved, but the runtime behavior is...

Source confirms concrete transmission of user command content and an authentication-like token to a remote endpoint. Although there is no install-time hook and the behavior is exam-trigge...

This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, including approval escalation and command hooks. It meets the firewall block boundary regar...

This is concrete, auto-starting cryptomining behavior in the published runtime entrypoint, not merely a suspicious primitive. The absence of install hooks does not mitigate runtime harm t...

Source confirms an npm lifecycle hook installs and activates a package-controlled plugin in the unrelated global Herdr environment. This meets the install-time foreign AI-agent control-su...

This is a concrete install-time AI-agent control-surface hijack, not merely an explicit setup command. The lifecycle hook suppresses output while creating persistent cross-agent configura...

The source establishes a concrete install-time chain from npm postinstall to foreign Herdr plugin deployment and detached execution. This meets the install-control-surface block condition...

This package is a deceptive, automatically activated browser cryptominer rather than the advertised common utility package. The lack of install hooks does not mitigate the runtime attack.

The lifecycle hook performs unconsented global installation of a foreign AI-agent CLI, which is a concrete install-time control-surface mutation. Benign desktop-shell functionality does n...

The runtime entry contains an automatically invoked, obfuscated Xelis mining payload with remote configuration, WebSocket, and Worker execution. This is concrete unauthorized cryptomining...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces and weakens approval/intercepts tool use. This meets the block boundary even without conf...

Direct source inspection confirms automatic credential upload to a fixed external receiver. The lack of npm lifecycle hooks does not mitigate this runtime exfiltration path.

The package contains a concrete automatic credential-upload path to a fixed third-party endpoint. Lack of an npm lifecycle hook limits activation but does not remove the runtime exfiltrat...

The source establishes a concrete default runtime path from business-operation records to embedded external webhooks. The absence of install hooks does not mitigate this runtime data-exfi...

The lifecycle hook performs the exact unconsented broad AI-agent configuration mutation reserved for blocking. The setup is package-owned but crosses multiple external agent configuration...

The automatic postinstall writes and activates a third-party Herdr plugin surface; this meets the install-control-surface block boundary. No lifecycle network exfiltration was found, but...

This is concrete browser cryptomining behavior, not a benign utility or merely suspicious primitive. Dynamic endpoint construction prevents naming a verified host, but does not weaken the...