npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-14017 blocks this version. LPM AI assessed this version as clean; the assessments disagree. npm/bs58-33 is a typosquat of the popular bs58 base58 cod...

OpenSSF/OSV malware advisory MAL-2026-14018 blocks this version. LPM AI assessed this version as clean; the assessments disagree. npm/bs58-77 is a typosquat of the popular bs58 base58 cod...

OpenSSF/OSV malware advisory MAL-2026-13964 blocks this version. LPM AI assessed this version as clean; the assessments disagree. npm/bs58-15 is a typosquat of the popular bs58 base58 cod...

This meets the install-control-surface block criterion: unconsented postinstall mutation of broad foreign AI-agent configurations. Runtime provider networking appears feature-aligned and...

Direct source inspection confirms automatic cross-platform agent configuration writes plus Claude Code permission expansion during postinstall. This meets the install-control-surface bloc...

The package contains a guarded but real postinstall path that performs privileged database administration against an embedded remote endpoint. This exceeds a UI theme library's expected b...

The package has a concrete install-time chain that silently modifies ~/.claude/settings.json and registers execution hooks. This meets the block policy for unconsented postinstall mutatio...

Source establishes an automatic, concealed third-party transfer of inbound photo attachments during normal chat-listening operation. The absence of install hooks does not mitigate this ru...

The source establishes a fixed default receiver, serializes secret values into a PUT request, and invokes that upload automatically in GitHub Actions. Absence of lifecycle hooks does not...

The package performs concrete automatic postinstall writes to Claude Code's global configuration and overrides its status line. Guard conditions and an npm update check do not remove that...

The automatic postinstall hook performs forced, recursive writes to both Codex and Claude Code skill locations. That concrete unconsented mutation meets the install-time foreign AI-agent...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, combined with persistence and machine-identity cloud registration. The global/macOS guards...

The concealed post-verification redirect and wholesale query forwarding are concrete browser-side attack behavior, not package-aligned functionality. It does not execute during npm instal...

This is concrete, unconsented postinstall mutation of foreign and broad AI-agent control surfaces, including permission settings. No network exfiltration is needed for the install-control...

This is an unconsented postinstall mutation of a foreign, global AI-agent control surface. The OAuth code is user-invoked and does not mitigate the install-time persistence.

Source directly confirms automatic, cross-agent skill installation during npm postinstall. This meets the blocking policy regardless of the absence of network activity in that lifecycle s...

Hardcoded default webhook destinations combined with automatic rich runtime logging form a concrete exfiltration chain. The absence of install hooks does not mitigate this application-run...

Although no network exfiltration was found, the package concretely performs unconsented postinstall mutation of broad third-party AI-agent control surfaces. This meets the firewall block...

This is a concrete unconsented npm postinstall mutation of a foreign AI-agent control surface. The conditional hook/MCP path does not mitigate the unconditional skills write.

The source establishes unconsented install-time host fingerprint exfiltration and system mutation, not merely dormant capability. The telemetry endpoint is identifiable, but that does not...

Source inspection confirms a deliberately obfuscated, unconditional browser redirect that forwards query parameters after a deceptive verification screen. The absence of install hooks lim...