npm security reports, with evidence.

Source inspection confirms an unverified, environment-configurable payload loader executed during postinstall. The shipped public module does not implement the README's TWAP functionality...

The shipped API does not need this installer, while its postinstall executes a remotely controlled dependency payload. This is concrete install-time remote code execution.

Source inspection confirms a concrete privileged remote-access persistence chain activated by postinstall, not merely a risky utility. Documentation does not make automatic hidden-account...

Source confirms an unconsented postinstall mutation of multiple foreign AI-agent control surfaces. This meets the firewall block policy regardless of the installer’s lack of network activ...

This is unconsented postinstall mutation of foreign/broad AI-agent environments, coupled with remote native payload installation. The source establishes the behavior directly.

Direct inspection found a concrete, undocumented third-party callback mechanism in the shipped executable. No install hook is needed for the runtime data-exfiltration risk to activate.

The postinstall hook performs concrete, unconsented collection and external transmission of local machine/user metadata. The benign-looking runtime analytics code does not mitigate this i...

Direct source inspection confirms unconsented install-time transmission of local host identity data to an opaque endpoint. This is concrete data exfiltration, not merely a noisy static he...

The unconsented postinstall collection and remote transmission of local host/user/path data is concrete install-time exfiltration. The runtime SDK code does not mitigate that behavior.

The package has a concrete, concealed install-time data-exfiltration path. The Sentry dynamic require is package-aligned and does not mitigate the lifecycle-hook behavior.

Direct source inspection confirms unconsented install-time host-fingerprint exfiltration. This is concrete malicious behavior, not a package-aligned feature.

Source confirms an unconsented install-time mutation of a broad, foreign AI-agent control surface. Per policy, this is a publish-block condition despite the absence of credential exfiltra...

Direct source inspection confirms an automatic install-time credential-exfiltration chain with no package-aligned purpose.

The package implements unconsented install-time secret collection and external exfiltration. Its comments and error suppression do not alter the concrete behavior.

Direct source inspection confirms install-time credential collection and external exfiltration, unrelated to the claimed AMM contracts/ABIs package.

This is unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the block boundary. No exfiltration or remote payload is needed for this concrete control-surface at...

Source confirms an unconsented postinstall mutation of ~/.agents/skills, a foreign/broad AI-agent control surface. This meets the blocking policy regardless of the unrelated CLI and Git-h...

The credential storage and remote job channel are reachable during ordinary runtime and use a package-default endpoint, not an installer-owned configuration. This is concrete exfiltration...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, combined with remote executable retrieval and host-level configuration changes. The global-install...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, compounded by unauthenticated remote binary execution and host configuration changes.