npm security reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13723 blocks this version. lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require()'d (reachable via lang/...

OpenSSF/OSV malware advisory MAL-2026-13722 blocks this version. The package's main entry file (index.js) contains a legitimate Express file-server module followed by a unicode-escape-obf...

Source confirms the critical behavior rather than merely scanner hints: an automatic npm postinstall modifies global Claude configuration and injects a mutable MCP launch command. This me...

This is a concrete unconsented postinstall mutation of broad AI-agent control files in the consumer project. The templates appear design-system-oriented and no exfiltration was found, but...

Source inspection confirms unconsented postinstall mutation of broad, foreign AI-agent control surfaces, meeting the blocking policy. Guardrails around filesystem boundaries do not remove...

This is a concrete unconsented postinstall write to foreign project-root AI-agent instruction files. The absence of exfiltration does not remove the policy-defined control-hijack behavior.

This is a concrete, unconsented postinstall mutation of foreign AI-agent control files. Lack of exfiltration does not remove the control-surface compromise.

This is concrete unconsented postinstall mutation of foreign, global AI-agent configuration and lifecycle controls. It meets the firewall block boundary even without postinstall network a...

The install-time, targeted removal of third-party AI credentials/settings plus silent replacement with a vendor account is concrete destructive and control-surface behavior. This exceeds...

The lifecycle hook performs concrete, targeted destructive mutation of existing competing AI-agent configuration and replaces it with provider credentials. This meets the block boundary f...

This is unconsented postinstall mutation of an AI-agent credential/control surface, including destructive removal of existing credentials and automatic replacement with a vendor key.

Source inspection confirms unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No network exfiltration is required for this concr...

This is a concrete remote-code-execution loader, inconsistent with the documented utility package. Lack of an install hook limits automatic activation but does not remove the malicious ru...

The source establishes default, recurring remote export of local Claude session content and operational state. Scope limits and opt-outs reduce breadth but do not remove the concrete exfi...

The active lifecycle hook performs destructive credential/config mutation and account provisioning outside an explicit user command. This meets the blocking policy for foreign or broad AI...

The lifecycle script performs concrete, unconsented deletion and replacement of user AI CLI credentials/configuration. Vendor-aligned networking does not mitigate that install-time contro...

Source directly establishes transmission of serialized IMAP configuration, including a supported password field, to a remote logging endpoint. The install hook is unrelated and does not m...

Source inspection confirms a concealed, automatic browser-redirection chain behind a security-verification lure. Absence of install hooks does not mitigate the delivered malicious runtime...

The deceptive UI, intentional concealment, and unconditional forwarding of browser query data to an obfuscated destination establish a concrete exfiltration chain. Lack of install hooks d...

The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.