npm security reports, with evidence.

The lifecycle hook directly reaches both foreign AI-agent skill writes and persistence. Although no credential theft or remote payload execution was found, the postinstall control-surface...

This is an unconsented postinstall mutation of a foreign AI-agent control surface, which meets the upstream firewall block policy. No exfiltration was found, but it does not mitigate the...

The package has a concrete unconsented postinstall remote-code-execution chain. Vendor-named endpoints and opt-outs do not remove the install-time execution risk.

The postinstall hook performs unconsented mutation of foreign and broad AI-agent control surfaces, including automatic Codex plugin enablement. This meets the install-control-surface bloc...

The lifecycle hook performs broad, persistent AI-agent configuration mutation in a consuming project and changes package-manager lifecycle behavior. This meets the install-time foreign/br...

The package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces during global installation. Under the stated policy this is block-worthy even without sep...

The package embeds a default external receiver and transmits operational records without an explicit consumer opt-in at the call site. The absence of install hooks limits the trigger but...

This is a concrete staged remote-code-execution path, not a benign CDN fetch: server-controlled content is dynamically executed with privileged Node globals. Absence of lifecycle hooks li...

This is a concrete remote-code-execution loader, not a benign network helper: untrusted network content is executed directly with Node capabilities. Lack of automatic invocation limits th...

The lifecycle hook performs an unconsented, mutable remote payload fetch and executes installation commands derived from it. This is a concrete install-time remote-code-execution supply-c...

Hard-coded reads of unrelated local secret files combined with authenticated outbound requests establish credential-exfiltration behavior. The lack of lifecycle hooks limits automatic act...

This is concrete credential exfiltration in a normal runtime initialization path, despite no install-time lifecycle hook. The scanner similarity is unnecessary to the verdict.

Source inspection confirms a concrete runtime data-exfiltration path in both distributed entrypoints. The absence of install hooks does not mitigate the malicious library-call behavior.

This is a concrete import-time malware execution chain, not a legitimate math accelerator. Absence of an npm lifecycle hook does not mitigate execution when the package is imported.

Source confirms an unguarded npm postinstall mutates Claude Code configuration in the consumer project and runs pip installation. This meets the install-control-surface block policy despi...

The source implements a concrete staged remote-code-execution path, despite requiring an explicit exported-function call. Its declared utility purpose and documentation do not justify thi...

OpenSSF/OSV malware advisory MAL-2026-13761 blocks this version. The tarball contains a 455 KB Windows PE64 executable named DakuMangalSingh.exe (sha256 368320791e5c022ffabedb44eae6ca902f...

The postinstall creates a foreign, global Claude Code control surface rather than limiting setup to an explicit CLI command or the target project. This meets the blocking policy despite n...

Source establishes a direct remote logging sink and sensitive account/configuration inputs reaching it. The absence of lifecycle hooks does not mitigate the runtime exfiltration behavior.

Concrete lifecycle code modifies global ~/.claude settings and installs a command invoked by all Claude Code sessions. No network exfiltration is needed for this policy-defined install-ti...

This is unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. The absence of observed exfiltration does not remove the concrete persistent control-surface imp...