npm detections from LPM Firewall.

The install hook unconditionally plants skills in Claude's home config and, when other agent directories exist, writes those control surfaces too, including enabling a Codex plugin and MC...

Unconsented postinstall rewrites the user-wide Claude Code control file and turns on prompt and tool export to a package-controlled collector. A later explicit CLI install does not author...

postinstall unconditionally installs skills into a wide set of home AI-agent directories, which is unconsented mutation of a foreign and broad agent control surface. The JavaScript shows...

A shortened, redirected remote payload piped to Bash is a concrete remote-code-execution sink. Its placement in a work-time command makes the behavior deceptive and malicious.

OpenSSF Malicious Packages via OSV confirms chai-logger@3.0.2 as malicious (MAL-2026-16380): Malicious code in chai-logger (npm)

The install lifecycle loads obfuscated probe code that sends username, hostname, and directory labels through DNS to oob.algamil7x.xyz. That is install-time data exfiltration, independent...

The install lifecycle unconditionally launches a binary whose documented job is to modify Codex and Claude Code hooks, skills, and a Codex setting. That is unconsented postinstall mutatio...

The active remote control path evaluates received JavaScript and exposes unrestricted host RPC. This is concrete remote code execution, not merely a configurable client capability.

The package ships a hardcoded curl-to-shell remote execution path and a caller that invokes it, including a CI job that updates from a local registry first. There is no install lifecycle...

The package automatically configures global Claude telemetry for an operator endpoint and enables collection of prompts and tool details. This satisfies the install-time foreign AI-agent...

The package has a concrete automatic postinstall path that broadly mutates foreign AI-agent skill directories. This meets the install-control-surface blocking policy.

This is an active install-time DNS exfiltration path, not a configuration registry function. The encoded implementation and external endpoint support malicious intent.

This is an automatic, obfuscated DNS exfiltration path unrelated to an ABI library. It activates both at install time and import time without consent.

The automatic postinstall hook modifies unoccupied global AI-agent command names, creating a concrete command-control hijack surface. Its guards reduce scope but do not provide prior cons...

The automatic postinstall hook mutates broad user-level Codex and Claude skill locations and can delete destination content. This is concrete install-hook abuse under the stated policy.

The automatic lifecycle hook mutates consumer package-manager configuration and AI-agent control files, then installs instructions designed to prevent review of those files. This is concr...

The package uses automatic install hooks to transmit host-identifying information to unrelated fixed external endpoints. This is concrete malicious data exfiltration behavior.

Automatic lifecycle hooks actively beacon local system metadata to fixed external endpoints. The behavior is concrete install-time data exfiltration, not normal package functionality.

This is concrete, automatic install-time collection and external transmission of host data. The behavior is not needed for the declared package and constitutes malicious data exfiltration.

Hard-coded remote webhook destinations combined with automatic serialization and sending of order-log payloads establish concrete data exfiltration behavior. The absence of an install hoo...

The package contains a complete active data-export path from runtime logger records to package-selected webhook recipients. The absence of an install hook limits the trigger but does not...