npm security reports, with evidence.

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, reinforced by persistent package-manager configuration changes. Lack of exfiltration does not remo...

This is an unconsented postinstall mutation of foreign, broad AI-agent control surfaces, not merely a user-invoked setup command. The absence of exfiltration does not remove the concrete...

This is concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Global-install gating and opt-outs reduce reach but do not establish c...

This is an unconsented npm postinstall mutation of foreign, broad AI-agent control surfaces, meeting the blocking policy. The remote executable download further expands the install-time e...

This is an unconsented npm postinstall mutation of multiple foreign AI-agent control surfaces, compounded by remote native payload execution. The global-install guard and opt-outs do not...

This is a concrete install-time mutation of foreign AI-agent control surfaces, compounded by unverified remote native payload execution. The global-install guard does not make the behavio...

Direct inspection confirms a foreign, unauthenticated-by-trusted-key remote binary source in the CLI execution path. Same-origin checksum validation does not mitigate malicious mirror-con...

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the blocking policy. No exfiltration is needed for this lifecycle hijack to be ha...

This is concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces. The absence of confirmed exfiltration does not mitigate the install-time control-surface hij...

The install hook performs the exact broad AI-agent control-surface mutation reserved for blocking. Lack of observed exfiltration does not mitigate the unconsented persistence and behavior...

This is concrete install-time mutation of broad, foreign AI-agent control surfaces without an explicit user command. The lack of detected exfiltration does not remove the persistence and...

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, meeting the blocking policy. No external exfiltration was needed to establish the harmful...

The install hook performs unconsented mutation of foreign, broad AI-agent control surfaces and approval settings. This meets the blocking policy even though no network exfiltration was fo...

Source inspection confirms the policy-defined blocking chain: automatic postinstall mutation of third-party AI-agent configuration, coupled with unverified native payload installation and...

This is concrete credential exfiltration to a non-Facebook package-controlled default endpoint, not merely Messenger API traffic. No install hook is needed because the harmful path is rea...

The shipped runtime contains a concrete remote-command execution path, not merely a risky primitive. Its explicit-user trigger does not remove the arbitrary server-supplied shell execution.

The install hook contains a concrete unconsented remote-code-execution chain, not merely a dormant capability. Its apparent runtime-bootstrap purpose does not mitigate execution of mutabl...

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces. The package’s permission hardening does not remove the lifecycle-based global control-surface write.

The hardcoded remote database is active by default and receives WhatsApp credential material during normal runtime. This is concrete credential exfiltration, not merely a noisy scanner ma...

The global-install lifecycle path is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces. Guardrails and lack of observed network activity do not remove...

This is concrete remote-code and broad AI-agent control-surface behavior, not merely a package-aligned downloader. No lifecycle hook mitigates the risk because the explicit CLI path perfo...