npm security reports, with evidence.

Source confirms automatic postinstall mutation of broad foreign AI-agent skill directories, including a remotely fetched mutable skill. This meets the blocking policy for unconsented life...

Source confirms an npm postinstall automatically injects package-controlled Claude Code skills into the consumer project and runs pip provisioning. This is concrete unconsented install-ti...

The package adds an unrelated preinstall loader that downloads and executes remote content, including a hard-coded mirror and time-gated fallback. This is concrete install-time remote cod...

The package has a concrete unconsented postinstall mutation of the global Claude Code control surface and installs a command that runs across all sessions. Lack of observed network exfilt...

The package deliberately exfiltrates caller-supplied decode input to an unrelated endpoint in both distributed entrypoints. This is concrete runtime data exfiltration, despite no install-...

A base encoding library has no legitimate need to transmit every decode input to an unrelated IP address. The concrete, duplicated runtime exfiltration behavior warrants blocking.

The automatic postinstall mutation of third-party AI-client MCP configurations meets the blocking policy. Remote native payload installation, persistence, and telemetry compound the contr...

The package has no install hook, but its normal agent runtime embeds covert collection instructions and tools that harvest sensitive user context. The behavior is concrete and exceeds a u...

The runtime entrypoint contains an explicit remote download-and-execute chain, corroborated by a bundled file that invokes it. Absence of an install hook does not mitigate this concrete r...

The source contains a concrete, reachable remote download-and-execute chain. Absence of an install hook limits automatic activation but does not remove the malicious runtime payload.

This is concrete install-time execution of a bundled surveillance and remote-control payload, not a package-aligned feature. The evidence supports a publish block.

The package has no install hook, but its normal exported runtime path silently installs and executes an unrelated external package. The obfuscation, hidden subprocess output, and dynamic...

This is a concrete install-time remote native-payload chain with explicit security-control evasion and per-user OS integration. A bundled hash check does not independently establish trust...

The package directly evaluates server-controlled content from a non-CDN host under the guise of icon/plugin fetching. Absence of install-time execution limits the trigger but does not rem...

This is a concealed staged remote-code-execution chain in a package presented as an SVG utility. It is reachable through documented runtime APIs, despite no install hook in this package's...

Source directly establishes automatic third-party transmission of account configuration with a credential-bearing field. The package lifecycle hook itself is not the malicious mechanism,...

Source inspection confirms a reachable remote-download-to-shell execution chain with no legitimate package functionality evident. Absence of lifecycle hooks limits automatic activation bu...

The lifecycle hook performs an unconsented postinstall mutation path across foreign AI-agent control surfaces, delegated to an unverified downloaded executable. That meets the firewall bl...

Source inspection confirms a postinstall-triggered, broad user-level AI-agent control-surface mutation. This meets the blocking policy regardless of the absence of confirmed network exfil...

Direct source inspection confirms unconsented install-time mutation of a consumer CI control surface and a persistent external reporting path. The browser bundle's Firebase traffic does n...

OpenSSF/OSV malware advisory MAL-2026-13747 blocks this version. base65-13x@5.0.2 impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decode(...