npm security reports, with evidence.

Source inspection confirms a concrete remote command-and-control path that invokes local coding agents without approval or sandbox protections. Explicit daemon installation is separate, b...

This is a concrete remote-control channel with arbitrary-root file read/write and local agent prompt execution, activated by a persistent daemon. The lack of install hooks reduces exposur...

The benign-looking date API is a wrapper around intentional import-time execution of a bundled backdoor binary. No install hook is needed because ordinary application imports activate it.

This is concrete, covert data-exfiltration behavior embedded in a package whose declared npm entrypoint is absent. Lack of an install hook reduces install-time exposure but does not make...

Direct source inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces and OS persistence. This meets the install-control-surface policy for blocking.

This is concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, compounded by download-and-execute of an unverified remote launcher.

The package contains a concrete remote command-execution channel in shipped runtime code, reachable through a documented CLI command. Absence of lifecycle hooks does not mitigate the resu...

Direct inspection confirms a concrete default postinstall control-surface mutation, not merely a scanner heuristic. Opt-out and idempotence do not provide prior consent.

Automatic unauthenticated remote code execution in an npm lifecycle hook is a concrete install-time attack surface. Runtime agent tools are package-aligned, but do not mitigate the lifecy...

Although there is no install-time hook, the source contains a concrete, enabled GitHub Actions path that transmits environment secrets to a package-controlled default endpoint. Remote def...

This is concrete stealth persistence and unconsented runtime package installation, not a normal explicit update command. The hard-coded telemetry destination compounds the risk.

This is a concrete, automatically triggered persistence and unattended remote-update chain, not a normal user-invoked update command. Absence of an npm lifecycle hook does not mitigate th...

Source directly establishes both remote binary execution and silent mutation of multiple third-party/global AI-agent instruction files during postinstall. This meets the block policy rega...

Source directly implements transmission of environment-derived credentials to a hardcoded third-party endpoint. The absence of an install hook reduces reachability but does not remove the...

Source confirms unconsented postinstall mutation of a broad, foreign AI-agent control surface. Lack of network activity does not mitigate this concrete install-time control injection.

The package performs unconsented install-time mutation of a foreign repository's privileged CI and release surface. This creates a concrete supply-chain persistence and publishing path de...

The source establishes a concrete, automatic credential-upload path to a package-vendor endpoint controlled by remotely hydrated definitions. The absence of an npm install hook reduces ex...

This is a concrete, unconsented install-time mutation of broad third-party AI-agent control surfaces. It meets the firewall block policy even though no credential exfiltration was observed.

The package implements concrete, undisclosed runtime exfiltration of user-entered notebook content to a remote audit endpoint. This is stronger evidence than the noisy reverse-shell hint...

Source establishes an installer-independent, remote privileged operator with filesystem and process control. This is a concrete backdoor rather than a normal WhatsApp bot administration f...