npm security reports, with evidence.

The concrete postinstall mutation of a foreign AI-agent dependency meets the install-control-surface block boundary. Network and credential code is package-aligned, but does not mitigate...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, meeting the blocking policy. No separate exfiltration chain is required for this verdict.

Direct manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-tim...

Source directly shows silent remote transmission of account configuration, including a serialized IMAP object, to a non-provider logging endpoint. The package's benign workspace postinsta...

The observable purpose is a keyboard notification utility, but its npm postinstall automatically injects executable hooks across third-party AI-agent configurations. That meets the firewa...

Source confirms a default third-party credential receiver in the standard runtime login path. Absence of install hooks does not mitigate this concrete credential-exfiltration behavior.

This is a concrete remote-code-execution loader disguised as a Tailwind plugin. Absence of an install hook limits the trigger but does not mitigate execution when the exported plugin is u...

The package's stated placeholder purpose does not require automatic external telemetry. Its postinstall beacon exfiltrates host-derived data through both HTTPS and DNS.

Direct inspection confirms the critical behavior is the guarded but automatic postinstall mutation of multiple foreign AI-agent control surfaces. The scanner's fixed-gateway credential-ex...

The confirmed postinstall mutation of ~/.claude/skills meets the policy threshold for an unconsented foreign/broad AI-agent control-surface write. The reverse-shell and credential-exfiltr...

The import-time updater silently installs a mismatched remote package into the caller's project. This is concrete unconsented remote code execution behavior, not a normal user-invoked upd...

The payload executes on package import and has a concrete network-to-eval-to-detached-process chain. The absence of lifecycle hooks does not mitigate import-time arbitrary code execution.

This is concrete, unconsented install-time privileged system mutation that creates a concealed remote-access path. The absence of observed exfiltration does not mitigate the backdoor beha...

The install-time behavior is unconsented and materially changes host authentication and network exposure. The absence of outbound JavaScript networking does not mitigate the local backdoo...

The lifecycle behavior is concrete and reaches global Claude Code skill/configuration surfaces without an explicit user command. This meets the firewall block policy irrespective of the a...

Source establishes a concrete default-enabled collection-and-exfiltration chain to a package-controlled public endpoint after plugin activation. The absence of an npm install hook does no...

Source establishes a concrete, default-enabled background exfiltration chain to a hardcoded public receiver. Absence of an npm lifecycle hook does not remove the risk once the explicit in...

This package contains no legitimate library implementation; its sole runtime artifact is an obfuscated, server-controlled redirect flow concealed behind a verification prompt.

OpenSSF/OSV malware advisory MAL-2026-14019 blocks this version. The OpenSSF Package Analysis project identified 'fr-ito-web-react' @ 99.99.99 (npm) as malicious.

This package has no library functionality: its sole entrypoint is a fake verification HTML page with an automatic, remote-controlled concealed redirect. That is concrete malicious browser...