npm security reports, with evidence.

The concrete install-time mutation of foreign AI-agent discovery directories meets the blocking policy. No separate exfiltration chain is needed for this control-surface hijack.

This is concrete unconsented postinstall mutation of foreign/broad AI-agent control surfaces, meeting the blocking policy. The absence of observed exfiltration does not mitigate that inst...

The package has a concrete automatic postinstall chain that installs its agent instructions into every detected supported platform. Local-only CLI behavior does not mitigate that unconsen...

Source inspection confirms a default third-party endpoint receives credentials on the normal login and auto-login paths. Documentation acknowledges an external API but does not remove the...

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. Safeguards against source-code changes and exfiltration do not remove that control-hijack...

Direct source inspection confirms install-time modification of a third-party AI-agent dependency. This meets the firewall block boundary for unconsented postinstall mutation of a foreign...

The install-time reverse shell is concrete, automatic remote command execution unrelated to date formatting. The package is malicious even though its auxiliary collection file is not invo...

The manifest directly defines an unconsented install-time reverse shell to a fixed external IP. The unused bundled reconnaissance/exfiltration script corroborates the malicious purpose.

Source establishes an install-independent remote privileged identity plus reachable file-write and restart capabilities. This is concrete remote code execution behavior, not a scanner-onl...

Source inspection confirms the critical behavior independently of scanner output. The lifecycle hook meets the firewall block policy despite no observed exfiltration or network activity i...

The package-default remote database receives WhatsApp authentication state, and fixed-recipient telemetry exposes paired-account metadata. These behaviors are reachable during normal runt...

Although npm installation has no install-time hook, the shipped extension combines broad all-site credential capture with a hard-coded remote default backend. That behavior is a concrete...

Source confirms unconsented install-time mutation of the broad Codex skill control surface. This meets the firewall block boundary regardless of the otherwise conventional CLI authenticat...

The source directly implements credential theft, remote command execution, C2 communication, and wallet draining; missing declared dependencies may impair execution but do not change its...

This package creates a concrete install-time remote-code-execution path and automatically invokes an AI-tool onboarding operation. Optional checksum comparison does not bind the payload t...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. It meets the firewall block boundary even though the postinstall itself has no observed ne...

The install hook performs forced, silent writes to foreign AI-assistant configuration locations without an explicit user command. This meets the firewall block policy for unconsented post...

Direct source inspection confirms an install-triggered external exfiltration callback. The benign placeholder runtime export does not mitigate the postinstall behavior.

The postinstall behavior is concrete, silent, and modifies consumer-owned AI-agent configuration by default. That meets the install-control-surface block boundary despite the absence of e...

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. Checksums mitigate the binary-download risk but do not remove t...

The bundled source confirms an unconsented postinstall mutation of foreign and broad AI-agent control surfaces. Benign-looking rule content does not remove this install-time control-surfa...