npm security reports, with evidence.

Direct source inspection confirms unconsented install-time network activity, not merely a static hint. No broader payload behavior was found, but the concrete lifecycle beacon warrants bl...

Source confirms persistent agent-hook installation and default outbound collection to a hard-coded non-domain endpoint. The lack of an npm lifecycle hook reduces install-time risk but doe...

The package’s stated telemetry purpose does not justify default persistent hooks that harvest multiple AI-agent session stores and transmit their metadata to a hard-coded, non-TLS IP endp...

The runtime backdoor performs unconsented, remotely controlled mutations of the user's authenticated WhatsApp account. Lifecycle hooks are benign, but do not mitigate this concrete behavior.

Concrete source establishes automatic credential-bearing configuration exfiltration to an unrelated endpoint. This is malicious despite otherwise package-aligned email and OAuth networking.

Source directly shows unconsented remote transmission of account configuration, including a path that serializes credentials. This is concrete credential exfiltration, not package-aligned...

This is a concrete runtime data-exfiltration path, not merely package-aligned IMAP/OAuth networking. The benign install hook and localhost MCP interface do not mitigate it.

Source directly establishes unconsented runtime credential-capable exfiltration. The install hook itself is benign, but it does not mitigate the Android data-exfiltration path.

The package contains an active runtime path that serializes sensitive IMAP configuration and silently sends it to an unrelated remote logging endpoint. The benign postinstall hook does no...

Source establishes automatic transmission of sensitive account configuration to an unrelated endpoint. The install hook itself is benign, but it does not mitigate the concrete runtime exf...

Source establishes an automatic external transmission of user mail-account metadata, not merely package-aligned mail-provider traffic. The benign lifecycle hook and loopback MCP server do...

This is a concrete credential-exfiltration path, not merely package-aligned mail or Google Drive traffic. No install hook is required, but ordinary Android runtime initialization activate...

Concrete runtime credential/configuration exfiltration to an unrelated endpoint is present in shipped JavaScript. No install hook is required for this malicious behavior.

Source establishes an unconditional, non-package-aligned network disclosure of account data and potentially credentials during ordinary runtime. The benign workspace postinstall hook does...

The package’s stated feature is implemented through an automatic postinstall mutation of several third-party/shared AI-agent skill locations. That concrete lifecycle control-surface write...

The source implements a direct remotely controlled code-execution path; the lack of an install hook only limits activation to runtime use.

The source establishes an unconsented remote logging path that can carry IMAP credentials, not merely package-aligned mail-provider traffic. The benign install hook and local token-gated...

This is a concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces. Localhost-only transport does not mitigate the install-time cross-agent registration.

The source confirms an unconsented postinstall write to a consumer Claude skill path. That meets the install-time foreign AI-agent control-surface mutation block boundary.

The package contains a default-enabled path that transfers environment secret values to a package-controlled external endpoint during normal GitHub Actions execution. No install hook is r...