npm security reports, with evidence.

The lifecycle hook performs a concrete, persistent write to ~/.claude/skills rather than merely printing setup guidance. This meets the blocking policy for unconsented postinstall mutatio...

The source establishes concrete identity-data exfiltration and a postinstall unchecked remote executable supply-chain surface. These behaviors exceed necessary package installation and co...

Source establishes concrete undisclosed identity exfiltration and an unchecked install-time native-payload chain. These are sufficient for a malicious firewall verdict.

Source establishes both an install-time unsigned executable supply chain and concrete user-identity disclosure. These are not merely scanner labels or dormant dependencies.

This is a credential-collection bot: sensitive WhatsApp auth state is persisted to a package-controlled remote database by default. The lifecycle script is not the issue; the runtime beha...

Source inspection confirms an unconsented postinstall write into foreign AI-agent control paths. The absence of network or credential theft narrows the behavior but does not remove the pr...

This is a concrete malicious chain, not merely a bootstrapper: it installs broad agent instructions and executes an unpinned remote native payload. Lack of an npm lifecycle hook does not...

Source establishes concrete credential exfiltration to a hard-coded third-party endpoint during an ordinary documented authentication flow. Lack of an install hook does not mitigate this...

Source directly confirms transmission of environment-derived secret values to a hard-coded external package service. The absence of install hooks limits the trigger but does not remove th...

Source inspection confirms intentional, concealed build-output injection and remote-triggered page replacement. This is concrete malicious behavior against consumers of the package.

This is concrete credential collection and remote transmission through a bundled all-sites browser extension with a non-local default backend. The absence of an npm install hook limits ac...

Source confirms concrete postinstall mutation of ~/.claude and ~/.codex, including Codex's default child-agent selection. That meets the block boundary for unconsented install-time mutati...

This is a concrete, persistent data-exfiltration chain, not merely an AI-agent configuration feature. It activates after a user-selected install, but the subsequent collection and upload...

Direct source inspection confirms an unconsented background chain from normal agent launches to collection and upload of local conversation content. This is concrete data exfiltration, no...

This is concrete, unconsented exfiltration of sensitive local AI-agent conversation data, not merely a user-requested upload feature. The lack of npm install hooks does not mitigate the r...

Source confirms automatic, cross-agent conversation harvesting and remote upload during ordinary CLI use. The absence of install hooks does not mitigate this concrete runtime data-exfiltr...

Source establishes a concrete, reachable automatic exfiltration chain rather than merely a user-invoked upload feature. No install-time hook is present, but runtime collection and upload...

The unconditional postinstall writes to ~/.claude, which is a broad foreign AI-agent control surface. Per policy this concrete unconsented mutation warrants blocking even though the defau...

This is a concrete unconsented postinstall write to a broad AI-agent control surface. Runtime authentication and network features do not mitigate that install-time persistence.

The package contains executable, unverified remote code replacement plus a server-controlled shell-injection primitive. These exceed the intended publishing function and create a concrete...

This is concrete credential exposure and a persistent author-controlled remote administration path, not merely a WhatsApp bot feature. The install hook is not the blocking behavior.