npm security reports, with evidence.

The package contains executable, unverified remote code replacement plus a server-controlled shell-injection primitive. These exceed the intended publishing function and create a concrete...

This is concrete credential exposure and a persistent author-controlled remote administration path, not merely a WhatsApp bot feature. The install hook is not the blocking behavior.

The source confirms an unconsented postinstall mutation chain affecting foreign AI-agent control surfaces. This meets the install-control-surface block policy despite no observed exfiltra...

This is concrete, unconsented postinstall mutation of a foreign AI-agent control surface, with persistent automatic execution. The conditional existence check does not make the configurat...

The package contains concrete, enabled-by-default transmission of rich application records to hardcoded external receivers. This is not install-time behavior, but it is a direct runtime d...

The source directly implements cross-vendor AI-agent configuration mutation during postinstall, which meets the blocking policy regardless of the absence of visible exfiltration in the la...

This is a concrete postinstall mutation of foreign, broad AI-agent control surfaces. The absence of network exfiltration does not mitigate the unconsented persistent instruction installat...

Source inspection confirms the critical behavior rather than relying on scanner labels. The automatic global agent-control mutation and unpinned future executable meet the block policy.

This is concrete install-time mutation of foreign AI-agent control files, not merely interactive first-party setup. The hidden quiet path also bootstraps and executes remote code.

The install-time mutation targets a foreign, broad AI-agent control surface and is unconsented. Managed-target safeguards do not remove the initial automatic injection.

The postinstall hook performs a concrete, persistent write outside its own package into a dependency's OAuth UI. Under the install-control-surface policy, this warrants blocking despite t...

The forced newsletter follow is concrete, runtime-reachable account manipulation, and fixed-recipient Telegram reporting creates a conditional data-exfiltration path. These behaviors are...

OpenSSF/OSV malware advisory MAL-2026-12108 blocks this version. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses Str...

Source inspection confirms a hard-coded third-party credential receiver in the normal runtime login path. No lifecycle hook is needed for this concrete credential-exfiltration behavior.

Although the bundled skill is documented and appears qgrid-specific, the postinstall hook automatically replaces foreign project and user-wide agent skill locations. That concrete install...

Source establishes a concrete default credential-exfiltration path to an endpoint unrelated to Facebook, activated by ordinary package use. No lifecycle hook is needed for the harmful beh...

The source establishes a concrete credential-exfiltration path to a package-controlled default datastore, not merely a legitimate user-selected backend. Shared-database job polling also g...

Source inspection confirms an unconsented postinstall modifies broad, foreign AI-agent configuration and installs persistent event hooks/extensions. This meets the install-control-surface...

This is a concrete unconsented postinstall mutation of broad, foreign AI-agent control surfaces, matching the block boundary. The lack of an install-time network call does not mitigate th...

The confirmed postinstall path automatically installs package-controlled agent instructions into multiple third-party/global agent directories. This meets the block policy for unconsented...

The install hook performs unconsented mutation of foreign AI-agent control files and consumer build configuration. This meets the policy boundary for a publish block despite no observed n...